Executive brief
MCPHub is a hub for centrally managing multiple MCP (model context protocol) servers and dynamically routing tool requests. An authentication gap in the tool-execution API allows any authenticated non-admin user to invoke tools on MCP servers owned by other users, even those they cannot see or access through normal interfaces. Since these servers are connected to real capabilities like filesystems, HTTP clients, and cloud APIs with owner credentials, an attacker can read arbitrary files, perform server-side request forgery (SSRF), and access other users' secrets or API keys.
Technical details
This is a horizontal privilege escalation (IDOR) vulnerability in MCPHub's tool-execution API. The vulnerability stems from an incomplete authorization check: while list views and configuration routes enforce server ownership via canAccessServer() and filterData(), the POST /api/tools/:serverName/:toolName execution endpoint resolves servers globally via getServerByName() without any ownership or admin check. An authenticated non-admin user can directly call this endpoint with any server name they discover (including through error messages or enumeration) to invoke tools. The attack vector is network-reachable, requires only a valid non-admin account (which an insider or tenant of a multi-tenant deployment would have), and requires no user interaction. PoC demonstrates arbitrary file read (/etc/passwd, user secrets) and SSRF attacks. The fix is to apply the existing ownership gate (canAccessServer) to the execution routes, either during server resolution or as a pre-execution check. Version 1.0.30 patches this by implementing group visibility and shared user functionality.
Affected products
- samanhappy MCPHub <= 1.0.29
Timeline
- 2026-08-23: disclosed
- 2026-08-20: patched: Version 1.0.30 released