CVE-2026-79748

Name of the Vulnerable Software and Affected Versions MCPHub versions prior to 0.12.15

Description Authenticated non-admin users can execute arbitrary processes as the server's OS user, which is often root in Docker, npx, or systemd deployments. This occurs because the 'POST /api/servers' and 'PUT /api/servers/:name' endpoints lack authorization checks and do not sanitize the command and args fields before passing them to the child process.spawn function.

Recommendations Update to version 0.12.15.