CyberRota Analysis
AI-GeneratedMCPHub versions prior to 1.0.30 are vulnerable, allowing authenticated non-admin users to execute tools on MCP servers owned by others, despite having no visibility of those servers. This flaw can lead to cross-tenant compromises, enabling unauthorized access to sensitive files and potential server-side request forgery (SSRF) attacks. Organizations using MCPHub should prioritize updating to the patched version to mitigate these significant security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.30, MCPHub scopes non-admin users to servers they own (list views and config edits enforce ownership), but the tool-execution API does not. Any authenticated non-admin user can invoke tools on MCP servers owned by other users — servers they cannot even see in GET /api/servers. Because connected MCP servers carry real capability (filesystem, HTTP fetch, cloud APIs with the owner's keys), this is cross-tenant compromise: demonstrated arbitrary host file read (/etc/passwd, another user's secrets) and SSRF. This issue has been patched in version 1.0.30.