CVE-2026-79750

Name of the Vulnerable Software and Affected Versions MCPHub versions prior to 1.0.30

Description An issue exists where the tool-execution API fails to enforce ownership scopes for non-admin users. While list views and configuration edits are restricted to servers owned by the user, the tool-execution API allows any authenticated non-admin user to invoke tools on MCP servers belonging to other users, including those not visible via the 'GET /api/servers' endpoint. This leads to cross-tenant compromise, enabling arbitrary host file reads and Server-Side Request Forgery (SSRF), a technique where an attacker induces the server to make requests to an unintended location.

Recommendations Update to version 1.0.30.