CVE-2026-79744CWE-269CWE-862broken-access-controlprivilege-escalation

CVE-2026-79744

High · published August 31, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
45.5
In the wild
Unconfirmed
What it is

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint (handler updateSystemConfig) performs no authorization check. It is protected only by the app-wide authentication middleware and a rate limiter — it never inspects req.user.isAdmin. This issue has been patched in version 1.0.29.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00555 · 45.5th percentile
Weaknesses
CWE-269 · Improper Privilege Management; CWE-862 · Missing Authorization
Published
2026-08-31T22:17Z
References (3)
https://github.com/samanhappy/mcphub/releases/tag/v1.0.29 · [email protected]https://github.com/samanhappy/mcphub/security/advisories/GHSA-4gc8-885f-qj36 · [email protected]https://github.com/samanhappy/mcphub/security/advisories/GHSA-4gc8-885f-qj36 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 02 SEP 03:39Z
    EPSS moved — → 0%
    epss
  • 31 AUG 17:56Z
    MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration
    cvelistv5