CVE-2026-79744

CVE-2026-79744 is a missing-authorization flaw (CWE-862, CWE-269) in MCPHub, an open-source hub for centrally managing and routing multiple MCP (Model Context Protocol) servers. The PUT /api/system-config endpoint, handled by updateSystemConfig, is protected only by the application-wide authentication middleware and a rate limiter, and never checks req.user.isAdmin, so any authenticated user — not just administrators — can change the hub's system configuration. An attacker with any valid low-privileged account can issue privileged configuration changes over the network, and the CVSS 3.1 vector (8.8, PR:L, C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact from such unauthorized changes. All MCPHub deployments running a version prior to 1.0.29 are affected, with exposure limited to instances where non-admin accounts exist. There is no known public proof of concept, the flaw is not in CISA KEV, and EPSS currently estimates only a 0.3% probability of exploitation within 30 days (22nd percentile).

What to do: Upgrade to MCPHub 1.0.29 or later, which adds the missing admin authorization check on the system-config endpoint. Until upgraded, restrict hub accounts to trusted administrators only, since any valid credential is sufficient to exploit, and review recent system-config changes for unauthorized modifications. Monitor for any PUT requests to /api/system-config from non-admin accounts.