CVE-2026-79744
Received Received - Intake

Unauthorized System Configuration Update in MCPHub

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint (handler updateSystemConfig) performs no authorization check. It is protected only by the app-wide authentication middleware and a rate limiter — it never inspects req.user.isAdmin. This issue has been patched in version 1.0.29.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-79744
EUVD
EUVD-2026-68690

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mcphub mcphub to 1.0.29 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-79744 is an authorization bypass vulnerability in MCPHub versions 1.0.28 and earlier. The PUT /api/system-config endpoint lacks proper admin checks, allowing any authenticated non-admin user to modify global security settings. This can enable unauthorized access to sensitive endpoints and system-wide security changes.

Detection Guidance

Check MCPHub versions before 1.0.29 by running: curl -s https://your-mcphub-instance.com/api/version or inspect package.json for version. Monitor PUT requests to /api/system-config in logs. Test for unauthorized access by sending a PUT request with a non-admin account to /api/system-config with body {"routing":{"skipAuth":true}} and verify if it succeeds.

Inspect src/routes/index.ts (line 266) and src/controllers/serverController.ts (line 1392) for missing admin checks in updateSystemConfig handler.

Impact Analysis

An attacker with a non-admin account could exploit this to rewrite security configurations, bypass authentication, access sensitive data like user lists, modify server settings, or perform supply-chain attacks. This could lead to data breaches, unauthorized system control, or service disruption.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized disclosures, or loss of audit controls, potentially leading to regulatory penalties.

Mitigation Strategies

Upgrade MCPHub to version 1.0.29 or later immediately. If upgrading is not possible, apply a patch to add admin authorization checks in the updateSystemConfig handler or enforce admin-only middleware for the /api/system-config endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79744. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart