CVE-2026-79749

Name of the Vulnerable Software and Affected Versions MCPHub versions prior to 1.0.32

Description An issue exists in the SSRF guard located in src/utils/ssrf.ts where the isBlockedIpv6() function fails to check IPv6 transition address families, specifically NAT64 (64:ff9b::/96), 6to4 (2002::/16), and Teredo (2001::/32). Server-Side Request Forgery (SSRF) is a technique where an attacker induces a server-side application to make requests to an unintended location. An attacker capable of specifying a URL for an MCP server connection can encode a private IPv4 address within these IPv6 forms to bypass the guard and access internal infrastructure.

Recommendations Update to version 1.0.32.