CVE-2026-79749

MCPHub, an open-source hub for centrally managing and routing multiple MCP servers, relies on an IPv6 blocklist in src/utils/ssrf.ts that fails to check IPv6 transition address families. An attacker who is able to specify the URL used for an MCP server connection can encode a private IPv4 address inside a NAT64 (64:ff9b::/96), 6to4 (2002::/16), or Teredo (2001::/32) IPv6 form, slipping past the isBlockedIpv6 check. This lets the attacker trigger server-side requests from the MCPHub instance toward internal infrastructure, with high confidentiality and integrity impact per the CVSS 4.0 score of 7.6. All MCPHub deployments prior to version 1.0.32 are affected, particularly instances where less-trusted users can register or modify MCP server connection URLs. There is no known in-the-wild exploitation, no public proof-of-concept, and a low predicted exploitation probability (EPSS 0.3%), though the flaw is straightforward to weaponize once known.

What to do: Upgrade MCPHub to version 1.0.32 or later. Restrict which users can add or modify MCP server connection URLs, and review existing server entries for IPv6 literals using NAT64, 6to4, or Teredo forms that point at private/internal addresses. Where feasible, limit the network reachability of the MCPHub host to internal services so successful SSRF attempts yield minimal access.