CVE-2026-108699: hyper-mcp through 0.8.3 Improper Signature Verification of OCI WebAssembly Plugins
hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosignverifyargs() accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image with a free Sigstore keyless certificate to execute plugins with configured host, filesystem, and environment capabilities.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Deployments of hyper-mcp through 0.8.3 are exposed when an attacker can control a WebAssembly plugin image reference. The impact depends on the host, filesystem, and environment capabilities configured for the plugin.
What does an attacker need to exploit this issue?
The attacker needs control of a plugin image reference and can sign a malicious image using a free Sigstore keyless certificate. No authentication or user interaction is required according to the supplied vector.
Are plugin signatures sufficient protection in the affected configuration?
No. The affected signature-verification behavior accepts any signer identity and OIDC issuer by default, allowing a malicious image with an otherwise valid keyless signature to be accepted.
How can I determine whether my deployment is affected?
Check whether hyper-mcp is version 0.8.3 or earlier and whether it loads OCI WebAssembly plugins from image references that an untrusted party could influence. Also review the capabilities granted to those plugins, including host, filesystem, and environment access.