CVE-2026-79750: MCPHub authenticated horizontal IDOR: any non-admin user executes tools on other users' MCP servers (cross-tenant file read + SSRF)
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.30, MCPHub scopes non-admin users to servers they own (list views and config edits enforce ownership), but the tool-execution API does not. Any authenticated non-admin user can invoke tools on MCP servers owned by other users — servers they cannot even see in GET /api/servers. Because connected MCP servers carry real capability (filesystem, HTTP fetch, cloud APIs with the owner's keys), this is cross-tenant compromise: demonstrated arbitrary host file read (/etc/passwd, another user's secrets) and SSRF. This issue has been patched in version 1.0.30.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MCPHubto a version that resolves this vulnerability.Fixed in 1.0.30
Event History
Frequently Asked Questions
Which deployments are exposed?
MCPHub deployments running versions before 1.0.30 are affected. The issue applies where non-admin users can authenticate and MCP servers are owned by different users or tenants.
What does an attacker need to exploit this issue?
An attacker needs valid authentication as any non-admin MCPHub user. No administrator privileges or user interaction are required, and the attacker can invoke tools on MCP servers owned by other users even when those servers are hidden from their server list.
What could an attacker do through another user's MCP server?
Impact depends on the capabilities and credentials attached to the target MCP server. Demonstrated impact includes reading host files such as /etc/passwd and another user's secrets, as well as SSRF; connected cloud APIs or other tools may be reachable using the owner's keys.
How can I remediate this vulnerability?
Upgrade MCPHub to version 1.0.30, which patches the missing ownership enforcement in the tool-execution API.