# CVE-2026-79746: MCPHub bearer key privilege escalation on group routes

Source: https://junglewise.ai/threats/cve-2026-79746-mcphub-bearer-key-privilege-escalation-on-group-routes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-79746 · Severity: high · CVSS 8.1 · Published 2026-08-31

MCPHub is a hub for managing and routing requests to multiple model context protocol (MCP) servers. A flaw in bearer token validation allows an API key scoped to access a single server to also access all other servers sharing the same group route, even if the key was never authorized for those servers. An attacker with a scoped API key can thereby bypass access controls and reach MCP servers they should not have permission to access.

Technologies: [Samanhappy Mcphub](https://junglewise.ai/threats/technologies/mcphub). Vendors: [Samanhappy](https://junglewise.ai/threats/vendors/samanhappy).

## Quick answers

**Is CVE-2026-79746 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79746 being exploited in the wild.

**How severe is CVE-2026-79746?** High severity, with a CVSS score of 8.1, published 31 August 2026.

**Which products and versions are affected?** Samanhappy Mcphub prior to 1.0.31.

**Is there a fix for CVE-2026-79746?** A patch was published on 2026-08-21: Patched in version 1.0.31 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-79746 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-79746?** Check whether you run Samanhappy Mcphub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass (CWE-863) in the `isBearerKeyAllowedForRequest` function in `src/services/sseService.ts`. When a bearer key with `accessType: 'servers'` or `'custom'` is used against a group route, the function incorrectly grants group-level access if any single server in that group matches the key's `allowedServers` list, using an "any-overlap" check (`Array.some`) instead of requiring full containment. Furthermore, once group-level access is granted, the `allowedServers` list is never re-checked downstream, allowing unrestricted access to all servers in the group. A bearer key scoped to one server therefore gains full access to every other server in the same group. The fix changes the authorization logic to require that every server in a group be in the key's `allowedServers` list (`Array.every`), and explicitly rejects empty groups. The patch was released in version 1.0.31.

## Affected products

- samanhappy MCPHub prior to 1.0.31

## Timeline

- 2026-08-31: disclosed: Published to NVD
- 2026-08-21: patched: Patched in version 1.0.31

## References

- [https://github.com/samanhappy/mcphub/commit/2b10ae36112ce68deebf910b22505d44efcef552](https://github.com/samanhappy/mcphub/commit/2b10ae36112ce68deebf910b22505d44efcef552)
- [https://github.com/samanhappy/mcphub/pull/1059](https://github.com/samanhappy/mcphub/pull/1059)

## Related threats

- [samanhappy MCPHub credential exfiltration via passthroughHeaders](https://junglewise.ai/threats/cve-2026-120323-a-security-flaw-has-been-discovered-in-samanhappy-mcphub-up-to-1)
- [samanhappy MCPHub privilege management in template import](https://junglewise.ai/threats/cve-2026-94047-a-security-vulnerability-has-been-detected-in-samanhappy-mcphub)
- [MCPHub OAuth 2.0 authentication bypass in authorization server](https://junglewise.ai/threats/cve-2026-90474-mcphub-oauth-2-0-authentication-bypass-in-authorization-server)
- [MCPHub horizontal privilege escalation in tool execution API](https://junglewise.ai/threats/cve-2026-79750-mcphub-horizontal-privilege-escalation-in-tool-execution-api)
- [MCPHub SSRF guard bypass in IPv6 transition address handling](https://junglewise.ai/threats/cve-2026-79749-mcphub-ssrf-guard-bypass-in-ipv6-transition-address-handling)