CyberRota Analysis
AI-GeneratedThe MCPHub application prior to version 1.0.29 is vulnerable due to a lack of authorization checks on the PUT /api/system-config endpoint, allowing unauthorized users to modify system configurations. This can lead to significant security risks, including unauthorized access and manipulation of server settings. Organizations using affected versions should prioritize updating to the patched version to mitigate potential exploitation of this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint (handler updateSystemConfig) performs no authorization check. It is protected only by the app-wide authentication middleware and a rate limiter — it never inspects req.user.isAdmin. This issue has been patched in version 1.0.29.