Severity Daily

IT and AI security incidents, checked against the primary source

Tag: MCPHub

  • Four of today’s nine stories are about the gap between a fix and the record of it

    Four of today’s nine stories are about the gap between a fix and the record of it

    The item to act on tonight is Ruby on Rails, and it is not the biggest-sounding thing that happened today. Rails’ patch for CVE-2026-66066 stops the file read that leaks secret_key_base. It does not stop the Marshal deserialization gadget that read exposed, which still executes on a fully patched server for anyone holding a valid key. An organization that upgraded in early August and did nothing else is closed to the theft and still open to code execution by whoever completed the theft first. Patch status and compromise status have come apart here, and the step that reconciles them — rotating secret_key_base and every other secret readable from the application process — is the one no scanner reports as missing. VulnCheck says exploitation began the week of August 24. That claim is thin, and it is not what should decide this: a working exploit against more than 7,100 exposed instances has been public since August 7.

    Bigger headlines were available today, and both of them shrank on inspection. The Justice Department rewrote its China hacking announcement so that NASA, the Federal Reserve, and the Senate are now “among the targets” of QTFY rather than its victims — a withdrawal, not an escalation. And a 9.8 critical CVE for the open-source project hulumi turns out to describe an over-permissive IAM policy in the project’s own CI sandbox account, a resource nobody who installs hulumi has.

    The day did have a thread, and it is a narrow one: in four of the nine stories, the fix and the record of the fix do not match. Rails is one. Nodemailer’s new 9.8 names 8.0.3 as the fixed version, and the 8.0.3 tarball on npm still carries the vulnerable line. Eight MCPHub CVEs published within a single second this afternoon carry fixes shipped between April 22 and August 23 — the critical remote code execution among them was fixed in May and disclosed today. And Eclipse Theia’s agent-mode workspace escape, an 8.8 that let the AI agent write and delete files outside the workspace on a model-supplied path, was closed in a release whose notes described the change only as a breaking API change. The engineering is not the failure in any of the four. The patch exists in all of them. What is unreliable is the thing a vulnerability management program actually reads.

    Second for most shops is Microsoft’s confirmation that Windows is falsely reporting Defender as turned off across effectively every supported client and server version, with no originating update to roll back, no named build to compare against, and alerts that persist even when notification settings are off. Expect it at the service desk at boot tomorrow, and brief staff with Get-MpComputerStatus rather than “ignore it” — the alert being trained out is the tamper signal.

    Then the rest. Seven ToolJet CVEs describe the same cross-tenant authorization gap in tooljet-db, and the worst of them carries a 9.9 and a 2.4 from the same scorer in the same record, against the vendor’s own 5.9. Nutex Health refiled its August 24 breach disclosure under Item 1.05 seven days later without adding the materiality determination that item exists for — a change of flag that automated screening will read and the filing’s own text contradicts.

    Still open: Microsoft has named neither the Defender build that causes the false alert nor a fix date. VulnCheck has published no correction on the ToolJet scoring conflict or the Nodemailer fixed-version range. The Justice Department has not said which, if any, of the seven named bodies QTFY actually compromised, and the pre-edit wording survives only in contemporaneous reporting. Nutex has not said whether it made a materiality determination, and the affected-individual count will come from state and federal breach portals, not EDGAR. And the Rails exploitation claim still rests on one social media post that VulnCheck’s own weekly report for that week does not list.

  • Eight MCPHub CVEs published in one second today, and the critical one was fixed in May

    Eight MCPHub CVEs published in one second today, and the critical one was fixed in May

    GitHub pushed eight CVE records for the Model Context Protocol hub into the National Vulnerability Database this afternoon, their fixes spread across six releases shipped between April 22 and August 23, and the path-traversal record among them is scored three different ways depending on where you read it.

    What happened

    Eight CVE records for MCPHub entered the National Vulnerability Database on Monday, August 31, 2026. The publication timestamps run from 6:17:19.610 p.m. UTC to 6:17:20.627 p.m. UTC — eight records in a little over one second. Every one carries [email protected] as its source identifier, and every one is still at NVD’s Received status, which means NVD has not analyzed any of them and every score on every record is GitHub’s.

    MCPHub is an open-source project by the developer samanhappy, published to npm as @samanhappy/mcphub. Its own description, repeated at the head of all eight CVE descriptions, is “a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies.” It is the piece of software an organization puts in front of a fleet of MCP servers so that its agents have one address to talk to.

    Here is the batch, with the fixed release named in each advisory and the date that release actually reached npm:

    CVE Flaw Score (source: GitHub) Fixed in Released to npm
    CVE-2026-79743 Path traversal via MCPB manifest name 6.9 medium (CVSS v4.0) 0.12.13 April 22, 2026
    CVE-2026-79748 Non-admin remote code execution via POST /api/servers 9.9 critical (CVSS v3.1) 0.12.15 May 2, 2026
    CVE-2026-79744 No authorization check on PUT /api/system-config 8.8 high (CVSS v3.1) 1.0.29 August 17, 2026
    CVE-2026-79750 Cross-tenant tool execution 7.7 high (CVSS v3.1) 1.0.30 August 20, 2026
    CVE-2026-79746 Bearer key scoped to one server grants a whole group 8.1 high (CVSS v3.1) 1.0.31 August 22, 2026
    CVE-2026-79745 No role check on prompt and resource writes 7.1 high (CVSS v3.1) 1.0.32 August 23, 2026
    CVE-2026-79747 Server-side request forgery, no egress filtering 7.1 high (CVSS v3.1) 1.0.32 August 23, 2026
    CVE-2026-79749 SSRF guard bypassed by IPv6 transition addresses 7.6 high (CVSS v4.0) 1.0.32 August 23, 2026

    The critical one is the oldest. GHSA-mx89-jjx9-gjr8, titled “Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args),” states plainly that “There is no authorization check restricting these endpoints to admins, and there is no allowlist/sanitization on the command and args fields.” The impact section says the result is “Remote code execution as the MCPHub process owner from a low-privilege authenticated account. In the official Docker image and in typical npx deployments, that user is root — full host compromise.” The reporter is credited as offset. The fix, version 0.12.15, went to npm on May 2, 2026, almost four months before the CVE record existed.

    The 8.8 record is close behind in reach if not in score. GHSA-4gc8-885f-qj36 says PUT /api/system-config is “protected only by the app-wide authentication middleware and a rate limiter,” so any authenticated non-admin can rewrite the settings that govern the whole instance. Setting skipAuth = true, the advisory notes, “converts the entire dashboard API into an unauthenticated admin surface,” and repointing values such as smartRouting.openaiApiBaseUrl or install.npmRegistry turns the hub into an exfiltration or supply-chain vector. GitHub’s summary calls it “a complete compromise of the instance and every tenant on it.” That advisory was published on August 17, 2026, credited to waydeshi.

    One record does not agree with itself across mirrors. CVE-2026-79743, the MCPB path traversal, is carried by NVD at 6.9 medium with the CVSS v4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X. GitHub’s own advisory page for GHSA-p3h2-2j4p-p83g gives 7.2 with a different v4.0 vector, AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H — privileges required low rather than none, and high integrity and availability impact rather than low and none. GitLab’s mirror of the same advisory publishes it as 8.1 high on CVSS v3.1. Same flaw, same assigning authority, three published severities, and the one that scanners consume from NVD is the only one that rates it medium. The two mirrors also disagree on the publication date: GitHub’s database gives April 19, 2026, GitLab’s gives April 22, 2026, which is the day the fixed release reached npm.

    The batch has no common scale. Six of the eight records carry a CVSS v3.1 vector and nothing else; two — CVE-2026-79743 and CVE-2026-79749 — carry a CVSS v4.0 vector and nothing else. Nothing on the records lets a reader rank the 7.6 against the 7.7, because they are not measured with the same instrument.

    The batch is also incomplete against its source. The repository’s advisory listing carries at least ten entries. Four — a template export that skips the ownership filter, an OAuth authorization server that does not enforce client authentication, cross-group tool execution via a missing group filter, and an open redirect in the OAuth denial flow — have no CVE at all. A keyword search of NVD for MCPHub returns twelve records in total: today’s eight plus four older ones from 2025 and April 2026. The cross-group tool execution advisory is rated high by GitHub and still has no CVE identifier.

    Why it matters

    An MCP hub is a credential concentrator by design. It holds every tenant’s server configuration, the OAuth client secrets, the JWT signing key, and the bearer keys, and it is wired to spawn processes and make outbound requests on behalf of whatever asks it to. That is the job. It means the interesting privilege boundary is not administrator versus anonymous, it is administrator versus ordinary authenticated user — and six of today’s eight records sit exactly on that line, requiring only low privileges.

    In a hub, “ordinary authenticated user” is frequently not a person. It is a service account, a CI job, or an agent holding its own bearer key. An agent that has been steered by a poisoned document or a hostile tool result is an authenticated low-privilege user with a shell, and CVE-2026-79748 turns that into code execution as root on the host in the project’s own container image. The defensive assumption that prompt injection is contained because the agent can only call approved tools does not survive a hub where calling an approved tool and registering a new one are the same permission.

    The timing is the second half of the problem, and it is the part that generalizes past this project. Severity Daily reported on Sunday that VulnCheck published thirteen MCP server CVEs in thirteen seconds. Today it is GitHub, eight records in about one second, for one project. The record for MCP infrastructure is arriving in bursts, months after the code was fixed, in batches large enough that no individual record gets read. An organization that patches on CVE feed learned today about a hole that was closed on May 2 — and if it is still on the 0.12 line, it learned about a hole it may still have.

    That inversion is worth naming. For most software the CVE is the early warning and the patch follows. Here the patch runs months ahead of the record, which makes the CVE feed a poor instrument for knowing whether your agent plumbing is current. Version currency is the better one, and few organizations yet apply it to the components their agents talk through.

    What to do

    Upgrade to 1.0.33, which reached npm on August 30, 2026 and is past every fixed version named in the eight advisories. There is no release that fixes only some of these; the fixes accumulated across 0.12.13, 0.12.15, 1.0.29, 1.0.30, 1.0.31, and 1.0.32.

    If you are pinned to the 0.12 line, know what that leaves you with: 0.12.15 closes the 9.9 and 0.12.13 closes the path traversal, but the 0.12 line carries none of the six August fixes, including the system-config authorization bypass and both SSRF issues.

    Independent of version, check three things. Confirm skipAuth is not set on your instance. Enumerate every non-admin account and bearer key that can reach the hub, including service and agent identities, and treat each as capable of everything described above on an unpatched build. And do not run the hub as root: the 9.9 advisory names the official Docker image and typical npx deployments as the case where the process owner is root, which is what converts a permissions bug into host compromise. Egress filtering in front of the hub limits both SSRF records; the IPv6 bypass in CVE-2026-79749 shows why the application’s own guard is not the place to rely on.

    Sourcing note

    Checked: NVD’s API records for CVE-2026-79743 through CVE-2026-79750, including publication timestamps, source identifiers, vulnerability status, and CVSS vectors; a keyword search of NVD for MCPHub, which returned twelve records; GitHub advisories GHSA-mx89-jjx9-gjr8, GHSA-4gc8-885f-qj36, and GHSA-p3h2-2j4p-p83g; the MCPHub repository’s advisory listing; GitLab’s advisory-database mirror of GHSA-p3h2-2j4p-p83g; and the npm registry metadata for @samanhappy/mcphub, which supplied the release dates for every version named above.

    Not resolved: NVD has not analyzed any of the eight records, so there is no independent score on any of them, and the medium rating on CVE-2026-79743 may change if NVD scores it. GitHub’s advisory page for GHSA-p3h2-2j4p-p83g did not show a CVE identifier at the time of checking even though NVD now maps CVE-2026-79743 to it. The two published dates for that advisory, April 19 and April 22, 2026, are reproduced as found rather than reconciled. No exploitation of any of the eight has been reported by GitHub, the maintainer, or any vendor, and none is claimed here. The four repository advisories without CVE identifiers are described from the repository’s own listing; whether identifiers are pending was not established.