CVE-2026-120323
Deferred Deferred - Pending Action

Information Disclosure in samanhappy MCPHub

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulDB

Description
A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120323

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an information disclosure flaw in samanhappy MCPHub versions up to 1.0.45/1.1.7. It allows remote attackers to manipulate the passthroughHeaders argument to disclose sensitive caller credentials. The issue occurs because the system forwards all specified headers directly from the caller's request without validation, enabling credential exfiltration.

Detection Guidance

Check if MCPHub versions up to 1.0.45 or 1.1.7 are installed. Review server configurations for passthroughHeaders settings that include sensitive headers like Authorization or Cookie. Monitor network traffic for unexpected header forwarding to external endpoints.

Impact Analysis

An attacker could exploit this to steal credentials like Authorization tokens, cookies, or API keys. This could lead to unauthorized access to accounts, data breaches, or full account takeover, especially if an administrator unknowingly uses a malicious server.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Upgrade to MCPHub version 1.1.8 or later. Apply the patch 040f7b9ae004070bdfe5084cde6bc2c609f78e76. Restrict passthroughHeaders to admin-only configurations and block sensitive headers like Authorization, Proxy-Authorization, Cookie, X-Auth-Token, and X-API-Key.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120323. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...