Eight MCPHub CVEs published in one second today, and the critical one was fixed in May

GitHub pushed eight CVE records for the Model Context Protocol hub into the National Vulnerability Database this afternoon, their fixes spread across six releases shipped between April 22 and August 23, and the path-traversal record among them is scored three different ways depending on where you read it.

What happened

Eight CVE records for MCPHub entered the National Vulnerability Database on Monday, August 31, 2026. The publication timestamps run from 6:17:19.610 p.m. UTC to 6:17:20.627 p.m. UTC — eight records in a little over one second. Every one carries [email protected] as its source identifier, and every one is still at NVD’s Received status, which means NVD has not analyzed any of them and every score on every record is GitHub’s.

MCPHub is an open-source project by the developer samanhappy, published to npm as @samanhappy/mcphub. Its own description, repeated at the head of all eight CVE descriptions, is “a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies.” It is the piece of software an organization puts in front of a fleet of MCP servers so that its agents have one address to talk to.

Here is the batch, with the fixed release named in each advisory and the date that release actually reached npm:

The critical one is the oldest. GHSA-mx89-jjx9-gjr8, titled “Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args),” states plainly that “There is no authorization check restricting these endpoints to admins, and there is no allowlist/sanitization on the command and args fields.” The impact section says the result is “Remote code execution as the MCPHub process owner from a low-privilege authenticated account. In the official Docker image and in typical npx deployments, that user is root — full host compromise.” The reporter is credited as offset. The fix, version 0.12.15, went to npm on May 2, 2026, almost four months before the CVE record existed.

The 8.8 record is close behind in reach if not in score. GHSA-4gc8-885f-qj36 says PUT /api/system-config is “protected only by the app-wide authentication middleware and a rate limiter,” so any authenticated non-admin can rewrite the settings that govern the whole instance. Setting skipAuth = true, the advisory notes, “converts the entire dashboard API into an unauthenticated admin surface,” and repointing values such as smartRouting.openaiApiBaseUrl or install.npmRegistry turns the hub into an exfiltration or supply-chain vector. GitHub’s summary calls it “a complete compromise of the instance and every tenant on it.” That advisory was published on August 17, 2026, credited to waydeshi.

One record does not agree with itself across mirrors. CVE-2026-79743, the MCPB path traversal, is carried by NVD at 6.9 medium with the CVSS v4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X. GitHub’s own advisory page for GHSA-p3h2-2j4p-p83g gives 7.2 with a different v4.0 vector, AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H — privileges required low rather than none, and high integrity and availability impact rather than low and none. GitLab’s mirror of the same advisory publishes it as 8.1 high on CVSS v3.1. Same flaw, same assigning authority, three published severities, and the one that scanners consume from NVD is the only one that rates it medium. The two mirrors also disagree on the publication date: GitHub’s database gives April 19, 2026, GitLab’s gives April 22, 2026, which is the day the fixed release reached npm.

The batch has no common scale. Six of the eight records carry a CVSS v3.1 vector and nothing else; two — CVE-2026-79743 and CVE-2026-79749 — carry a CVSS v4.0 vector and nothing else. Nothing on the records lets a reader rank the 7.6 against the 7.7, because they are not measured with the same instrument.

The batch is also incomplete against its source. The repository’s advisory listing carries at least ten entries. Four — a template export that skips the ownership filter, an OAuth authorization server that does not enforce client authentication, cross-group tool execution via a missing group filter, and an open redirect in the OAuth denial flow — have no CVE at all. A keyword search of NVD for MCPHub returns twelve records in total: today’s eight plus four older ones from 2025 and April 2026. The cross-group tool execution advisory is rated high by GitHub and still has no CVE identifier.

Why it matters

An MCP hub is a credential concentrator by design. It holds every tenant’s server configuration, the OAuth client secrets, the JWT signing key, and the bearer keys, and it is wired to spawn processes and make outbound requests on behalf of whatever asks it to. That is the job. It means the interesting privilege boundary is not administrator versus anonymous, it is administrator versus ordinary authenticated user — and six of today’s eight records sit exactly on that line, requiring only low privileges.

In a hub, “ordinary authenticated user” is frequently not a person. It is a service account, a CI job, or an agent holding its own bearer key. An agent that has been steered by a poisoned document or a hostile tool result is an authenticated low-privilege user with a shell, and CVE-2026-79748 turns that into code execution as root on the host in the project’s own container image. The defensive assumption that prompt injection is contained because the agent can only call approved tools does not survive a hub where calling an approved tool and registering a new one are the same permission.

The timing is the second half of the problem, and it is the part that generalizes past this project. Severity Daily reported on Sunday that VulnCheck published thirteen MCP server CVEs in thirteen seconds. Today it is GitHub, eight records in about one second, for one project. The record for MCP infrastructure is arriving in bursts, months after the code was fixed, in batches large enough that no individual record gets read. An organization that patches on CVE feed learned today about a hole that was closed on May 2 — and if it is still on the 0.12 line, it learned about a hole it may still have.

That inversion is worth naming. For most software the CVE is the early warning and the patch follows. Here the patch runs months ahead of the record, which makes the CVE feed a poor instrument for knowing whether your agent plumbing is current. Version currency is the better one, and few organizations yet apply it to the components their agents talk through.

What to do

Upgrade to 1.0.33, which reached npm on August 30, 2026 and is past every fixed version named in the eight advisories. There is no release that fixes only some of these; the fixes accumulated across 0.12.13, 0.12.15, 1.0.29, 1.0.30, 1.0.31, and 1.0.32.

If you are pinned to the 0.12 line, know what that leaves you with: 0.12.15 closes the 9.9 and 0.12.13 closes the path traversal, but the 0.12 line carries none of the six August fixes, including the system-config authorization bypass and both SSRF issues.

Independent of version, check three things. Confirm skipAuth is not set on your instance. Enumerate every non-admin account and bearer key that can reach the hub, including service and agent identities, and treat each as capable of everything described above on an unpatched build. And do not run the hub as root: the 9.9 advisory names the official Docker image and typical npx deployments as the case where the process owner is root, which is what converts a permissions bug into host compromise. Egress filtering in front of the hub limits both SSRF records; the IPv6 bypass in CVE-2026-79749 shows why the application’s own guard is not the place to rely on.

Sourcing note

Checked: NVD’s API records for CVE-2026-79743 through CVE-2026-79750, including publication timestamps, source identifiers, vulnerability status, and CVSS vectors; a keyword search of NVD for MCPHub, which returned twelve records; GitHub advisories GHSA-mx89-jjx9-gjr8, GHSA-4gc8-885f-qj36, and GHSA-p3h2-2j4p-p83g; the MCPHub repository’s advisory listing; GitLab’s advisory-database mirror of GHSA-p3h2-2j4p-p83g; and the npm registry metadata for @samanhappy/mcphub, which supplied the release dates for every version named above.

Not resolved: NVD has not analyzed any of the eight records, so there is no independent score on any of them, and the medium rating on CVE-2026-79743 may change if NVD scores it. GitHub’s advisory page for GHSA-p3h2-2j4p-p83g did not show a CVE identifier at the time of checking even though NVD now maps CVE-2026-79743 to it. The two published dates for that advisory, April 19 and April 22, 2026, are reproduced as found rather than reconciled. No exploitation of any of the eight has been reported by GitHub, the maintainer, or any vendor, and none is claimed here. The four repository advisories without CVE identifiers are described from the repository’s own listing; whether identifiers are pending was not established.