https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 03:16:35 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-79748 <p>MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endpoints in MCPHub create/update MCP server configurations and then immediately spawn the configured stdio process via child_process.spawn. Authentication is required, but there is no authorization check restricting these endpoints to admins, and there is no allowlist/sanitization on the command and args fields. As a result, any authenticated non-admin user can submit a server configuration with command:&#34;/bin/sh&#34; (or any other binary) and arbitrary args, causing MCPHub to execute the attacker-controlled process as the MCPHub server&#39;s OS user (commonly root in the published Docker image and in npx/systemd deployments). This issue has been patched in version 0.12.15.</p> <p>MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endpoints in MCPHub create/update MCP server configurations and then immediately spawn the configured stdio process via child_process.spawn. Authentication is required, but there is no authorization check restricting these endpoints to admins, and there is no allowlist/sanitization on the command and args fields. As a result, any authenticated non-admin user can submit a server configuration with command:&#34;/bin/sh&#34; (or any other binary) and arbitrary args, causing MCPHub to execute the attacker-controlled process as the MCPHub server&#39;s OS user (commonly root in the published Docker image and in npx/systemd deployments). This issue has been patched in version 0.12.15.</p> https://db.gcve.eu/vuln/fkie_cve-2026-79748