CVE-2026-79744: MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint (handler updateSystemConfig) performs no authorization check. It is protected only by the app-wide authentication middleware and a rate limiter — it never inspects req.user.isAdmin. This issue has been patched in version 1.0.29.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MCPHubto a version that resolves this vulnerability.Fixed in 1.0.29
Event History
Frequently Asked Questions
Which deployments are exposed?
MCPHub deployments running versions earlier than 1.0.29 are affected if the PUT /api/system-config endpoint is reachable through the application’s normal authentication flow. The endpoint is protected by app-wide authentication and rate limiting, but not by an administrator-role check.
What access does an attacker need?
An attacker needs an authenticated non-administrator account. No administrator privileges or user interaction are required, and the attack can be performed remotely over the network.
What is the impact of successful exploitation?
A non-admin user can rewrite global system security configuration. The provided severity vector indicates potential high impact to confidentiality, integrity, and availability.
How should this be remediated?
Upgrade MCPHub to version 1.0.29, which includes the authorization check for this endpoint. If upgrading cannot happen immediately, restrict access to MCPHub to trusted authenticated administrators and review non-admin accounts that could access the API.