Executive brief
MCPHub is a hub for managing and routing connections to multiple MCP servers. An attacker who can control server URLs can bypass security restrictions by using special IPv6 address formats to reach internal systems that should be inaccessible. This could allow compromise of internal infrastructure, data exfiltration, or lateral movement within a network.
Technical details
MCPHub's SSRF (Server-Side Request Forgery) guard in src/utils/ssrf.ts implements a custom isBlockedIpv6 function that is incomplete. It checks only for loopback, link-local, unique-local, IPv4-mapped, and IPv4-compatible IPv6 addresses but fails to block IPv6 transition address families: NAT64 (64:ff9b::/96 and 64:ff9b:1::/48), 6to4 (2002::/16), Teredo (2001::/32), site-local (fec0::/10), and multicast (ff00::/8). An attacker can specify an MCP server URL using these transition formats to encode private IPv4 addresses, thereby bypassing the SSRF blocklist and reaching internal infrastructure. The vulnerability is network-reachable and requires only the ability to specify a server URL. Patches are available in version 1.0.32 and later.
Affected products
- samanhappy MCPHub before 1.0.32
Timeline
- 2026-08-31: disclosed
- 2026-08-23: patched: Fix merged in PR #1069