TI-2026-63284 Aliases CVE-2026-94047 GHSA-2xcr-p42x-hfx6

samanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges management

MEDIUM 57CWE-266Published 2026-09-20 · Updated 2026-09-22

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Privilege escalation
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-266.

Summary

A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32. The impacted element is the function importTemplate of the file src/services/templateService.ts of the component Template Import Endpoint. The manipulation leads to improper privilege management. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Upgrading to version 1.0.33 is sufficient to resolve this issue. The identifier of the patch is 18a4467bc4ec6390b1f841d8a468a37e9922f837. It is advisable to upgrade the affected component.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00427 37th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed MCPHub (samanhappy): 1.0.33

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
samanhappy	MCPHub	1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; 1.0.6; 1.0.7; 1.0.8; 1.0.9; 1.0.10; 1.0.11; 1.0.12; 1.0.13; 1.0.14; 1.0.15; 1.0.16; 1.0.17; 1.0.18; 1.0.19; 1.0.20; 1.0.21; 1.0.22; 1.0.23; 1.0.24; 1.0.25; 1.0.26; 1.0.27; 1.0.28; 1.0.29; 1.0.30; 1.0.31; 1.0.32	1.0.33	Patch available	CNA

MCPHub Vendorsamanhappy Affected 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; 1.0.6; 1.0.7; 1.0.8; 1.0.9; 1.0.10; 1.0.11; 1.0.12; 1.0.13; 1.0.14; 1.0.15; 1.0.16; 1.0.17; 1.0.18; 1.0.19; 1.0.20; 1.0.21; 1.0.22; 1.0.23; 1.0.24; 1.0.25; 1.0.26; 1.0.27; 1.0.28; 1.0.29; 1.0.30; 1.0.31; 1.0.32 Fixed in 1.0.33 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:samanhappy:mcphub::::::::	—	—	—

cpe:2.3:a:samanhappy:mcphub:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA MCPHub (samanhappy) Fixed in 1.0.33

Timeline

2026-10-02 Threatist record created from CVE-2026-94047
2026-10-03 Alias added: GHSA-2xcr-p42x-hfx6

References

Exploit 1

https://github.com/samanhappy/mcphub/issues/1094

Patch 3

Other 1

https://github.com/samanhappy/mcphub/

TI-2026-55229 MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args) CVSS 3.1CRITICAL 9.9
TI-2026-55225 MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration CVSS 3.1HIGH 8.8
TI-2026-55224 MCPHub: Path Traversal via Malicious MCPB Manifest Name CVSS 4.0MEDIUM 6.9
TI-2025-10335 samanhappy MCPHub sseService.ts handleSseConnectionfunction improper authentication CVSS 4.0MEDIUM 6.9
TI-2026-61501 MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass CVSS 4.0HIGH 7.6
TI-2026-55230 MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation CVSS 4.0HIGH 7.6

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences