CVE-2026-120323

A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.

• CWE-200
• CWE-284

• https://github.com/0xGenesi/CVE/blob/main/MCPHub_OpenAPI_passthroughHeaders_Credential_Exfiltration.md
• https://github.com/samanhappy/mcphub/
• https://github.com/samanhappy/mcphub/commit/040f7b9ae004070bdfe5084cde6bc2c609f78e76
• https://github.com/samanhappy/mcphub/releases/tag/v1.1.8
• https://vuldb.com/cve/CVE-2026-120323
• https://vuldb.com/submit/1015029
• https://vuldb.com/vuln/429655
• https://vuldb.com/vuln/429655/cti
• https://github.com/0xGenesi/CVE/blob/main/MCPHub_OpenAPI_passthroughHeaders_Credential_Exfiltration.md

Published

Nov 2, 2026

Last Modified

Nov 2, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-120317http4k from 4.9.10.0 before 6.60.0.0 contains a missing inte…5.9
• CVE-2026-120318Product Gallery Slider & Additional Variation Images for Woo…7.2
• CVE-2026-120319A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. …6.3
• CVE-2026-12032Inappropriate implementation in Passwords in Google Chrome o…3.1
• CVE-2026-120320A vulnerability was determined in jxxghp MoviePilot up to 3.…4.7
• CVE-2026-120322A vulnerability was identified in Termix-SSH Termix up to 2.…9.9
• CVE-2026-120324A weakness has been identified in Aklivity Zilla up to 1.3.4…8.3
• CVE-2026-120325A security vulnerability has been detected in Webpro-nl Knip…6.3
• CVE-2026-120327The click tracking middleware accepts an arbitrary target UR…5.3
• CVE-2026-120328The click tracking middleware does not validate the authenti…6.9
• CVE-2026-120329Saving the configuration of the mail backend module writes s…5.3
• CVE-2026-12033Out of bounds read in VideoCapture in Google Chrome prior to…5.3