Read the docs

hyper-mcp-rs

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

hyper-mcp-rs records in CISA KEV

No hyper-mcp-rs vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-70679 CVE-2026-108699 · GHSA-4j25-h357-wg62

hyper-mcp loads WebAssembly plugins without proper signature verification

Priority HIGH 69

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign_verify_args() accepts any signer identity and OIDC issuer by de…

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00169 Published 2026-10-11 No fix listed CWE-347
TI-2026-70678 CVE-2026-108698 · GHSA-phv4-c98f-77h3

TOCTOU race in hyper-mcp lets attackers load unsigned plugins

Priority LOW 36

hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/oci.rs that verifies the Cosign signature of a separately resolved tag rather than the loaded manifest.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00243 Published 2026-10-11 No fix listed CWE-367
Open these records in search →