CVE-2026-79748

MCPHub before version 0.12.15 fails to enforce admin-only authorization (CWE-862) on the POST /api/servers and PUT /api/servers/:name endpoints, and applies no allowlist or sanitization to the command and args fields used to launch MCP server processes. Any authenticated non-admin user can submit a server configuration containing an arbitrary binary (e.g., /bin/sh) and arguments, which MCPHub immediately spawns via child_process.spawn. Because the spawned process runs as the MCPHub server's OS user — commonly root in the published Docker image and in npx/systemd deployments — an attacker gains arbitrary command execution on the host, consistent with the CVSS scope-change and critical 9.9 rating. All MCPHub deployments prior to 0.12.15 are affected, with the greatest risk in multi-user deployments exposed over the network. Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days.

What to do: Upgrade MCPHub to version 0.12.15 immediately. Until patched, restrict POST/PUT access to the /api/servers endpoints (e.g., via a reverse-proxy ACL), minimize non-admin accounts, run the MCPHub process as a non-root user instead of the default root in Docker/npx/systemd setups, and audit existing server configurations for unexpected command or args values. Environment-wide, check for anomalous spawned processes executed under the MCPHub service account that could indicate prior abuse.