Read the docs
TI-2026-83674 Aliases CVE-2026-120323GHSA-c48q-fjwh-j7gg

Information disclosure in samanhappy MCPHub header passthrough

Priority MEDIUM 57CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-284.

Summary

samanhappy MCPHub versions from 1.0.0 before 1.1.8 are affected. A flaw in how the passthroughHeaders argument is handled in src/utils/passthroughHeaders.ts exposes sensitive information (CWE-200). A remote attacker without privileges can obtain this information, though the attack requires some user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00371 31st percentileScored 2026-11-07
Fix Fixed MCPHub (samanhappy): 1.1.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
samanhappyMCPHub1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; 1.0.6; 1.0.7; 1.0.8; 1.0.9; 1.0.10; 1.0.11; 1.0.12; 1.0.13; 1.0.14; 1.0.15; 1.0.16; 1.0.17; 1.0.18; 1.0.19; 1.0.20; 1.0.21; 1.0.22; 1.0.23; 1.0.24; 1.0.25; 1.0.26; 1.0.27; 1.0.28; 1.0.29; 1.0.30; 1.0.31; 1.0.32; 1.0.33; 1.0.34; 1.0.35; 1.0.36; 1.0.37; 1.0.38; 1.0.39; 1.0.40; 1.0.41; 1.0.42; 1.0.43; 1.0.44; 1.0.45; 1.1.0; 1.1.1; 1.1.2; 1.1.3; 1.1.4; 1.1.5; 1.1.6; 1.1.71.1.8Patch availableCNA
  • MCPHub Vendorsamanhappy Affected 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; 1.0.6; 1.0.7; 1.0.8; 1.0.9; 1.0.10; 1.0.11; 1.0.12; 1.0.13; 1.0.14; 1.0.15; 1.0.16; 1.0.17; 1.0.18; 1.0.19; 1.0.20; 1.0.21; 1.0.22; 1.0.23; 1.0.24; 1.0.25; 1.0.26; 1.0.27; 1.0.28; 1.0.29; 1.0.30; 1.0.31; 1.0.32; 1.0.33; 1.0.34; 1.0.35; 1.0.36; 1.0.37; 1.0.38; 1.0.39; 1.0.40; 1.0.41; 1.0.42; 1.0.43; 1.0.44; 1.0.45; 1.1.0; 1.1.1; 1.1.2; 1.1.3; 1.1.4; 1.1.5; 1.1.6; 1.1.7 Fixed in 1.1.8 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:samanhappy:mcphub:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:samanhappy:mcphub:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Upgrade samanhappy MCPHub to version 1.1.8, which contains the patch 040f7b9ae004070bdfe5084cde6bc2c609f78e76.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA MCPHub (samanhappy) Fixed in 1.1.8

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-120323
  2. 2026-11-02 Alias added: GHSA-c48q-fjwh-j7gg
  3. 2026-11-02 CISA SSVC decision points changed
  4. 2026-11-02 Priority changed: LOW → MEDIUM

References

Patch 2

Other 2

  • TI-2026-55229 MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args) CVSS 3.1CRITICAL 9.9
  • TI-2026-55225 MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration CVSS 3.1HIGH 8.8
  • TI-2026-55224 MCPHub: Path Traversal via Malicious MCPB Manifest Name CVSS 4.0MEDIUM 6.9
  • TI-2025-10335 samanhappy MCPHub sseService.ts handleSseConnectionfunction improper authentication CVSS 4.0MEDIUM 6.9
  • TI-2026-61501 MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass CVSS 4.0HIGH 7.6
  • TI-2026-55230 MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation CVSS 4.0HIGH 7.6
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences