Vulnerabilities

Filters

1 selected

15 records

Sort

Vendor: samanhappy Clear all filters

TI-2026-83674 CVE-2026-120323 · GHSA-c48q-fjwh-j7gg

Information disclosure in samanhappy MCPHub header passthrough

MEDIUM 57

A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00371 Published 2026-11-02 Fixed in 1.1.8 CWE-200

TI-2026-63284 CVE-2026-94047 · GHSA-2xcr-p42x-hfx6

samanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges management

MEDIUM 57

A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00427 Published 2026-09-20 Fixed in 1.0.33 CWE-266

TI-2026-61501 CVE-2026-90474 · GHSA-c47m-m826-fc8g

MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass

HIGH 68

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00553 Published 2026-09-12 Fixed in 1.0.32 CWE-287

TI-2026-55224 CVE-2026-79743

MCPHub: Path Traversal via Malicious MCPB Manifest Name

HIGH 70

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00537 Published 2026-08-31 Fixed in 0.12.13 CWE-22

TI-2026-55225 CVE-2026-79744

MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration

HIGH 73

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00555 Published 2026-08-31 Fixed in 1.0.29 CWE-269

TI-2026-55226 CVE-2026-79745

Missing authorization in samanhappy mcphub

MEDIUM 64

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00439 Published 2026-08-31 Fixed in 1.0.32 CWE-862

TI-2026-55227 CVE-2026-79746

MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching

LOW 38

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00426 Published 2026-08-31 Fixed in 1.0.31 CWE-863

TI-2026-55228 CVE-2026-79747

Server-side request forgery in samanhappy mcphub

MEDIUM 64

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00301 Published 2026-08-31 Fixed in 1.0.32 CWE-918

TI-2026-55229 CVE-2026-79748

MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)

HIGH 76

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00635 Published 2026-08-31 Fixed in 0.12.15 CWE-862

TI-2026-55230 CVE-2026-79749

MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation

HIGH 68

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00449 Published 2026-08-31 Fixed in 1.0.32 CWE-918

TI-2026-55231 CVE-2026-79750

Authorization bypass in samanhappy mcphub

HIGH 67

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00429 Published 2026-08-31 Fixed in 1.0.30 CWE-639

TI-2025-12636 CVE-2025-13822 · GHSA-9vq7-9h42-j88h

Authentication bypass in MCPHub

LOW 24

MCPHub in versions below 0.11.0 is vulnerable to authentication bypass.

CVSS 4.0MEDIUM 5.3 Adjacent network No auth No interaction EPSS 0.00353 Published 2026-04-14 Fixed in 0.11.0 CWE-639

TI-2025-10335 CVE-2025-11287 · GHSA-v7c4-33vf-cqqq

samanhappy MCPHub sseService.ts handleSseConnectionfunction improper authentication

HIGH 70

A vulnerability was identified in samanhappy MCPHub up to 0.9.10.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00563 Published 2025-10-05 No fix listed CWE-287

TI-2025-10334 CVE-2025-11286 · GHSA-h3mq-gv39-g8gh

samanhappy MCPHub MCPRouter Service serverController.ts server-side request forgery

MEDIUM 56

A vulnerability was determined in samanhappy MCPHub up to 0.9.10.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00311 Published 2025-10-05 No fix listed CWE-918

TI-2025-10333 CVE-2025-11285 · GHSA-5q2p-3jg8-2m98

samanhappy MCPHub serverController.ts os command injection

MEDIUM 57

A vulnerability was found in samanhappy MCPHub up to 0.9.10.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.07857 Published 2025-10-05 No fix listed CWE-77