CVE-2026-108698: hyper-mcp through 0.8.3 OCI Plugin Signature Verification TOCTOU Race Condition
hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in loadwasm in src/wasm/oci.rs that verifies the Cosign signature of a separately resolved tag rather than the loaded manifest. Attackers controlling registry responses for the tag can serve an unsigned malicious manifest to the loader and a signed one to Cosign, executing unsigned WebAssembly plugins with configured host capabilities.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using hyper-mcp through version 0.8.3 that load WebAssembly plugins from OCI tags and rely on Cosign signature verification are exposed. The impact applies when an attacker can control registry responses for the referenced tag.
What does an attacker need to exploit it?
The attacker needs the ability to cause different registry responses for the tag resolution used by the loader and the resolution used by Cosign. They can then provide a signed manifest to Cosign while causing the loader to fetch an unsigned malicious manifest.
What is the practical impact if exploitation succeeds?
An unsigned WebAssembly plugin can be executed despite signature verification. That plugin executes with the host capabilities configured for it, which may allow integrity-impacting actions and limited confidentiality impact.
How can I determine whether my deployment is affected?
Check whether hyper-mcp is version 0.8.3 or earlier and whether its OCI plugin-loading path is used with tag-based references. Systems that do not load OCI WebAssembly plugins through this path are not described as affected by the available information.