Executive brief
MCPHub is a hub for managing and routing requests to multiple model context protocol (MCP) servers. A flaw in bearer token validation allows an API key scoped to access a single server to also access all other servers sharing the same group route, even if the key was never authorized for those servers. An attacker with a scoped API key can thereby bypass access controls and reach MCP servers they should not have permission to access.
Technical details
The vulnerability is an authorization bypass (CWE-863) in the `isBearerKeyAllowedForRequest` function in `src/services/sseService.ts`. When a bearer key with `accessType: 'servers'` or `'custom'` is used against a group route, the function incorrectly grants group-level access if any single server in that group matches the key's `allowedServers` list, using an "any-overlap" check (`Array.some`) instead of requiring full containment. Furthermore, once group-level access is granted, the `allowedServers` list is never re-checked downstream, allowing unrestricted access to all servers in the group. A bearer key scoped to one server therefore gains full access to every other server in the same group. The fix changes the authorization logic to require that every server in a group be in the key's `allowedServers` list (`Array.every`), and explicitly rejects empty groups. The patch was released in version 1.0.31.
Affected products
- samanhappy MCPHub prior to 1.0.31
Timeline
- 2026-08-31: disclosed: Published to NVD
- 2026-08-21: patched: Patched in version 1.0.31