# CVE-2026-120323: samanhappy MCPHub credential exfiltration via passthroughHeaders

Source: https://junglewise.ai/threats/cve-2026-120323-a-security-flaw-has-been-discovered-in-samanhappy-mcphub-up-to-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-120323 · Severity: medium · CVSS 4.3 · Published 2026-11-02

MCPHub is a self-hosted gateway that routes requests to multiple AI/MCP servers. An unprivileged user can trick administrators or other users into forwarding their authentication credentials (API keys, session cookies, bearer tokens) to an attacker-controlled server by registering a malicious OpenAPI endpoint configured to pass through sensitive headers. This allows complete credential theft of any user who calls a tool on the compromised server.

Technologies: [Samanhappy Mcphub](https://junglewise.ai/threats/technologies/mcphub). Vendors: [Samanhappy](https://junglewise.ai/threats/vendors/samanhappy).

## Quick answers

**Is CVE-2026-120323 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120323 being exploited in the wild.

**How severe is CVE-2026-120323?** Medium severity, with a CVSS score of 4.3, published 2 November 2026.

**Which products and versions are affected?** Samanhappy Mcphub up to 1.0.45 and 1.1.0–1.1.7.

**Is there a fix for CVE-2026-120323?** Yes: fixed in 1.1.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120323 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-120323?** Check whether you run Samanhappy Mcphub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.1.8

## Technical details

The vulnerability is an information disclosure (CWE-200) in passthroughHeaders handling: MCPHub collects all request headers from the caller (including Authorization, Cookie, and X-Api-Key) and forwards them verbatim to an attacker-controlled upstream URL if they are listed in the openapi.passthroughHeaders configuration. No denylist blocks credential headers, and non-privileged users can register such configurations. Exploitation requires authentication to MCPHub (to register the server or call a tool) and user interaction (victim must invoke a tool on the malicious server), but results in credential exfiltration with no attack complexity.

## Affected products

- samanhappy MCPHub up to 1.0.45 and 1.1.0–1.1.7

## Timeline

- 2026-11-02: disclosed

## References

- [https://github.com/0xGenesi/CVE/blob/main/MCPHub_OpenAPI_passthroughHeaders_Credential_Exfiltration.md](https://github.com/0xGenesi/CVE/blob/main/MCPHub_OpenAPI_passthroughHeaders_Credential_Exfiltration.md)
- [https://github.com/samanhappy/mcphub/](https://github.com/samanhappy/mcphub/)

## Related threats

- [samanhappy MCPHub privilege management in template import](https://junglewise.ai/threats/cve-2026-94047-a-security-vulnerability-has-been-detected-in-samanhappy-mcphub)
- [MCPHub OAuth 2.0 authentication bypass in authorization server](https://junglewise.ai/threats/cve-2026-90474-mcphub-oauth-2-0-authentication-bypass-in-authorization-server)
- [MCPHub horizontal privilege escalation in tool execution API](https://junglewise.ai/threats/cve-2026-79750-mcphub-horizontal-privilege-escalation-in-tool-execution-api)
- [MCPHub SSRF guard bypass in IPv6 transition address handling](https://junglewise.ai/threats/cve-2026-79749-mcphub-ssrf-guard-bypass-in-ipv6-transition-address-handling)
- [MCPHub privilege escalation in server configuration endpoints](https://junglewise.ai/threats/cve-2026-79748-mcphub-privilege-escalation-in-server-configuration-endpoints)