CVE-2026-79747

MCPHub before 1.0.32 is vulnerable to server-side request forgery (CWE-918): an authenticated non-admin user can register an MCP server that points to an arbitrary URL, causing the hub to issue server-side requests to it with no egress filtering of loopback, RFC1918 private ranges, or link-local 169.254.0.0/16. An attacker triggers the flaw by adding a server registration that targets an internal or metadata URL; via the OpenAPI proxy path the response body is returned to the caller, yielding fully reflected SSRF, while via the SSE/streamable-http transport the request is sent blind. Because internal addresses are reachable, an attacker with a non-admin account can probe and, in the reflected case, read responses from services on localhost and private subnets as well as the cloud metadata endpoint (169.254.169.254), potentially exposing internal data or credentials. Only deployments of MCPHub prior to 1.0.32 that allow non-admin authenticated users to register servers are affected. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS estimates a low (~0.2%) probability of exploitation within 30 days.

What to do: Upgrade to MCPHub 1.0.32 or later, which adds egress filtering for loopback, RFC1918 and 169.254.0.0/16. Until upgraded, limit server registration to trusted users and apply network-level egress controls so the hub cannot reach internal services or the cloud metadata endpoint, and review existing registered servers for entries pointing at internal or metadata URLs while checking logs for unexpected SSRF-style requests.