CVE-2026-79745

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts* and POST/PUT /api/resources* routes are attached to the authenticated router with no admin gate, and the handlers never read req.user. The DAO singletons they write are consulted first — ahead of any connected MCP server — for every session in handleGetPromptRequest / handleReadResourceRequest. A non-admin can therefore create, overwrite, and shadow global prompt templates and resources that all other users are served. The scored impact is the unauthorized integrity violation (creation/tampering/shadowing of globally-served records); stored prompt injection into other users' LLM sessions is a downstream consequence of that tampering. This issue has been patched in version 1.0.32.

• CWE-862

• https://github.com/samanhappy/mcphub/commit/6ba55ac63954a71506e61c088753251e2ff643cf
• https://github.com/samanhappy/mcphub/pull/1069
• https://github.com/samanhappy/mcphub/releases/tag/v1.0.32
• https://github.com/samanhappy/mcphub/security/advisories/GHSA-6cvf-cfch-4g7m
• https://github.com/samanhappy/mcphub/security/advisories/GHSA-6cvf-cfch-4g7m

Published

Aug 31, 2026

Last Modified

Sep 8, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7974Use after free in Blink in Google Chrome prior to 148.0.7778…8.8
• CVE-2026-79740Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell…7.5
• CVE-2026-79741Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell…5.3
• CVE-2026-79742IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote a…8.8
• CVE-2026-79743MCPHub is a unified hub for centrally managing and dynamical…6.9
• CVE-2026-79744MCPHub is a unified hub for centrally managing and dynamical…8.8
• CVE-2026-79746MCPHub is a unified hub for centrally managing and dynamical…8.1
• CVE-2026-79747MCPHub is a unified hub for centrally managing and dynamical…7.1
• CVE-2026-79748MCPHub is a unified hub for centrally managing and dynamical…9.9
• CVE-2026-79749MCPHub is a unified hub for centrally managing and dynamical…7.6
• CVE-2026-7975Use after free in DevTools in Google Chrome prior to 148.0.7…8.3
• CVE-2026-79750MCPHub is a unified hub for centrally managing and dynamical…7.7