Quick answers
- Is CVE-2026-79744 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-79744 being exploited in the wild.
- How severe is CVE-2026-79744?
- High severity, with a CVSS score of 8.8, published 31 August 2026.
- Which products and versions are affected?
- Samanhappy Mcphub <= 1.0.28.
- Is there a fix for CVE-2026-79744?
- A patch was published on 2026-08-17: Version 1.0.29 released with authorization check added Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-79744 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-79744?
- Check whether you run Samanhappy Mcphub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a missing authorization check on the PUT /api/system-config endpoint (updateSystemConfig handler). While the endpoint is protected by app-wide authentication middleware, it never verifies the req.user.isAdmin property before accepting configuration updates. The handler destructures fields directly from req.body and merges them into the persisted systemConfig without any role-based access control. An authenticated non-admin user can single-handedly enable routing.skipAuth=true to bypass authentication globally, rewrite OAuth settings, redirect smartRouting.openaiApiBaseUrl for supply-chain attacks, or weaken other security-relevant fields. The vulnerability is patched in version 1.0.29 by adding an admin authorization gate.
Affected products
- samanhappy MCPHub <= 1.0.28
Timeline
- 2026-08-17: disclosed
- 2026-08-17: patched: Version 1.0.29 released with authorization check added