Is CVE-2026-79748 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79748 being exploited in the wild.

How severe is CVE-2026-79748?

Critical severity, with a CVSS score of 9.9, published 31 August 2026.

Which products and versions are affected?

Samanhappy Mcphub before 0.12.15.

Is there a fix for CVE-2026-79748?

A patch was published on 2026-05-02: version 0.12.15 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-79748 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-79748?

Check whether you run Samanhappy Mcphub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79748: MCPHub privilege escalation in server configuration endpoints

CVE-2026-79748 · Severity: critical · CVSS 9.9 · Published 2026-08-31

MCPHub is a centralized platform for managing and routing requests to multiple MCP servers. Prior to version 0.12.15, authenticated non-admin users could create or update MCP server configurations with arbitrary shell commands, which MCPHub would then execute immediately as its own OS user (often root). This allows any logged-in non-admin user to run malicious commands with elevated privileges, potentially compromising the entire system.

Technologies: Samanhappy Mcphub. Vendors: Samanhappy.

Quick answers

Is CVE-2026-79748 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79748 being exploited in the wild.
How severe is CVE-2026-79748?: Critical severity, with a CVSS score of 9.9, published 31 August 2026.
Which products and versions are affected?: Samanhappy Mcphub before 0.12.15.
Is there a fix for CVE-2026-79748?: A patch was published on 2026-05-02: version 0.12.15 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79748 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-79748?: Check whether you run Samanhappy Mcphub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass and arbitrary command execution in the POST /api/servers and PUT /api/servers/:name endpoints. These endpoints accept command and args parameters for spawning child processes via child_process.spawn, but they only check authentication (login required) without verifying if the user is an admin or validating the command/args values. An authenticated non-admin user can submit a crafted server configuration containing command:"/bin/sh" or similar with arbitrary arguments, causing MCPHub to execute the attacker-controlled process with the privileges of the MCPHub server process (typically root in Docker and systemd deployments). The fix in version 0.12.15 enforces admin-only authorization and hardens ownership checks on mutating endpoints.

Affected products

samanhappy MCPHub before 0.12.15

Timeline

2026-08-31: disclosed
2026-05-02: patched: version 0.12.15 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.