Executive brief
MCPHub is a unified hub for managing and orchestrating multiple MCP servers/APIs into separate endpoints. Prior to version 1.0.32, non-admin users could create or modify global prompt templates and resources that are served to all other users on the platform. This allows attackers to inject malicious content into other users' LLM sessions or shadow legitimate resources with unauthorized versions.
Technical details
The vulnerability is an authorization bypass in the built-in prompt and resource controllers. The mutating POST/PUT endpoints for /api/prompts* and /api/resources* are attached to the authenticated router without admin-level access checks, and the handlers never validate the requesting user's role. Because the DAO singletons that store these mutations are consulted first—ahead of connected MCP servers—for every session in handleGetPromptRequest and handleReadResourceRequest, a non-admin attacker can create or overwrite global prompt templates and resources visible to all users. The fix, released in version 1.0.32, gates create/update/delete operations behind a requireAdmin helper while keeping read operations open to all authenticated users.
Affected products
- samanhappy MCPHub before 1.0.32
Timeline
- 2026-08-31: disclosed
- 2026-08-23: patched: Version 1.0.32 released with fix (requireAdmin helper added to prompt/resource mutations)