CVE-2026-79748: MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endpoints in MCPHub create/update MCP server configurations and then immediately spawn the configured stdio process via childprocess.spawn. Authentication is required, but there is no authorization check restricting these endpoints to admins, and there is no allowlist/sanitization on the command and args fields. As a result, any authenticated non-admin user can submit a server configuration with command:"/bin/sh" (or any other binary) and arbitrary args, causing MCPHub to execute the attacker-controlled process as the MCPHub server's OS user (commonly root in the published Docker image and in npx/systemd deployments). This issue has been patched in version 0.12.15.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MCPHubto a version that resolves this vulnerability.Fixed in 0.12.15 - Compensating control
If upgrading is not immediately possible, restrict access to MCPHub's authenticated API endpoints POST /api/servers and PUT /api/servers/:name so only admins (authorized users) can reach them.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated MCPHub user, including a non-admin user, can exploit it. The attacker needs access to an account that can authenticate to the MCPHub instance; no administrator privileges or user interaction are required.
What privileges would successful exploitation provide?
The configured process runs as the operating-system user running MCPHub. This is commonly root in the published Docker image and in npx or systemd deployments, so exploitation may result in root-level code execution.
Are both server-configuration endpoints affected?
Yes. Before version 0.12.15, both POST /api/servers and PUT /api/servers/:name can create or update a configuration that immediately spawns an attacker-selected stdio command with arbitrary arguments.
How can I determine whether my deployment is exposed?
Deployments running a version earlier than 0.12.15 are affected if non-admin users can authenticate to MCPHub. Review server configuration creation and update activity for unexpected commands, arguments, or server entries, particularly configurations invoking shells or unrecognized binaries.
What should be done if immediate upgrading is not possible?
Limit MCPHub access to trusted administrators and remove or disable non-admin accounts where feasible, since any authenticated non-admin account can trigger the vulnerable endpoints. Also run MCPHub under a minimally privileged OS account rather than root to reduce the impact of process execution.