Executive brief
MCPHub is a centralized platform for managing and routing requests to multiple MCP servers. Prior to version 0.12.15, authenticated non-admin users could create or update MCP server configurations with arbitrary shell commands, which MCPHub would then execute immediately as its own OS user (often root). This allows any logged-in non-admin user to run malicious commands with elevated privileges, potentially compromising the entire system.
Technical details
The vulnerability is an authorization bypass and arbitrary command execution in the POST /api/servers and PUT /api/servers/:name endpoints. These endpoints accept command and args parameters for spawning child processes via child_process.spawn, but they only check authentication (login required) without verifying if the user is an admin or validating the command/args values. An authenticated non-admin user can submit a crafted server configuration containing command:"/bin/sh" or similar with arbitrary arguments, causing MCPHub to execute the attacker-controlled process with the privileges of the MCPHub server process (typically root in Docker and systemd deployments). The fix in version 0.12.15 enforces admin-only authorization and hardens ownership checks on mutating endpoints.
Affected products
- samanhappy MCPHub before 0.12.15
Timeline
- 2026-08-31: disclosed
- 2026-05-02: patched: version 0.12.15 released