Executive brief
MCPHub is a middleware platform that manages and routes requests to multiple API servers. An authenticated user without admin privileges can register a malicious server pointing to any internal URL, forcing MCPHub to make HTTP requests to those targets. The responses are returned directly to the attacker, allowing them to read internal service responses (including cloud metadata, admin APIs, or other loopback services) and perform blind HTTP requests to internal systems.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in MCPHub's server registration endpoint (POST /servers). Non-admin authenticated users can register OpenAPI or URL-based servers without egress filtering or destination validation. Two exploitation paths exist: (1) reflected SSRF via the OpenAPI proxy, where OpenAPIClient.callTool() requests a user-supplied URL and returns the response body to the caller, and (2) blind SSRF via transport creation, where SSEClientTransport or StreamableHTTPClientTransport connect to arbitrary URLs. The vulnerability allows access to RFC1918 addresses, loopback interfaces (127.0.0.1), and link-local addresses (169.254.0.0/16), potentially exposing cloud instance metadata services (IMDS) and internal admin APIs. The fix in version 1.0.32 adds egress controls to block these address ranges and enforces validation on all user-supplied URLs before connection.
Affected products
- samanhappy MCPHub <1.0.32
Timeline
- 2026-08-23: disclosed
- 2026-08-23: patched: Version 1.0.32 released with SSRF egress controls