CVE-2026-79745: MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts and POST/PUT /api/resources routes are attached to the authenticated router with no admin gate, and the handlers never read req.user. The DAO singletons they write are consulted first — ahead of any connected MCP server — for every session in handleGetPromptRequest / handleReadResourceRequest. A non-admin can therefore create, overwrite, and shadow global prompt templates and resources that all other users are served. The scored impact is the unauthorized integrity violation (creation/tampering/shadowing of globally-served records); stored prompt injection into other users' LLM sessions is a downstream consequence of that tampering. This issue has been patched in version 1.0.32.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MCPHubto a version that resolves this vulnerability.Fixed in 1.0.32
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated non-admin user can exploit it. The affected routes require authentication but, before version 1.0.32, do not enforce an administrative role check.
What can an attacker change, and who is affected?
An attacker can create or overwrite built-in prompts and resources through the mutating prompt and resource API routes. Because these stored records are consulted before connected MCP servers for every session, they can shadow globally served templates or resources for other users.
Are default deployments affected?
Deployments running a version earlier than 1.0.32 are affected if non-admin authenticated users can access the built-in prompt or resource mutation routes. The vulnerable routes are attached to the authenticated router without an admin gate.
How can I determine whether tampering may already have occurred?
Review built-in prompt and resource records for unexpected creations, modifications, or entries that shadow expected MCP-server-provided templates or resources. Pay particular attention to records that would be served globally ahead of connected MCP server content.
What is the remediation?
Upgrade MCPHub to version 1.0.32, which includes the patch. Until upgrading, restrict access to authenticated non-admin users who could invoke the prompt and resource POST or PUT routes.