CVE-2026-79750

MCPHub before version 1.0.30 fails to enforce server-ownership checks on its tool-execution API: while the server list (GET /api/servers) and configuration-edit endpoints restrict non-admin users to MCP servers they own, the tool-invocation endpoint accepts any server identifier. As a result, any authenticated non-admin user can invoke tools on MCP servers owned by other users, including servers they cannot even see in the list view. Because connected MCP servers carry real capabilities, such as filesystem access, HTTP fetching, and cloud APIs authenticated with the owner's keys, this enables cross-tenant access, demonstrated as arbitrary host file reads (e.g., /etc/passwd and another user's secrets) and server-side request forgery. Only MCPHub deployments prior to 1.0.30 that have multiple users with non-admin accounts are meaningfully exposed; single-admin self-hosted setups are largely unaffected. No public proof-of-concept or in-the-wild exploitation is known, EPSS estimates about a 0.3% probability of exploitation in the next 30 days, and the issue is not in CISA KEV; the fix shipped in version 1.0.30.

What to do: Upgrade to MCPHub 1.0.30 or later, which restores ownership enforcement on the tool-execution API. Operators of multi-user deployments should review logs for tool invocations against servers not owned by the calling user and treat host files and API keys reachable through other users' MCP servers (filesystem, fetch, and cloud-API tools) as potentially disclosed. As an interim mitigation, restrict non-admin account creation or limit network access to the tool-execution API until patched.