CVE-2026-79746
Received Received - Intake

Authorization Bypass in MCPHub via Group Route

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.31, when a bearer key with accessType: 'servers' (or 'custom') is used against a group route, isBearerKeyAllowedForRequest grants access to the entire group as long as any single server in that group appears in the key's allowedServers list — not only when every server the key is scoped to matches, and critically, without ever re-checking allowedServers again once the group-level connection is authorized. A key explicitly scoped to one specific server therefore also grants full access to every other server that happens to share a group with it, including servers the key was never authorized for. This issue has been patched in version 1.0.31.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-79746
EUVD
EUVD-2026-68688

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
samanhappy mcphub to 1.0.31 (exc)
mcphub mcphub to 1.0.31 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-79746 is an authorization bypass vulnerability in MCPHub versions prior to 1.0.31. It involves bearer keys scoped to specific servers that incorrectly grant access to entire server groups if any server in the group is included in the key's allowed list. The flaw occurs because the system checks for any overlap between allowed servers and group servers, rather than requiring full containment. This allows unauthorized access to sensitive servers within a group.

Detection Guidance

To detect this vulnerability, check if your MCPHub instance is running a version prior to 1.0.31. Use commands like 'npm list mcphub' or inspect the package version in your deployment logs. Verify if bearer keys with accessType 'servers' or 'custom' are granting unintended group access by reviewing authorization logs for group route requests.

Impact Analysis

This vulnerability could allow attackers to gain unauthorized access to servers they are not explicitly permitted to access. If a bearer key is scoped to one server in a group, it may grant access to all other servers in that group, potentially exposing sensitive data or systems. The impact includes data breaches, unauthorized actions, and compromised integrity of the MCPHub deployment.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR and HIPAA by enabling unauthorized access to sensitive data. GDPR requires strict access controls and data protection measures, while HIPAA mandates safeguards to ensure only authorized personnel access protected health information. The flaw undermines these requirements by allowing unauthorized access.

Mitigation Strategies

Immediately upgrade MCPHub to version 1.0.31 or later. Review all bearer keys with accessType 'servers' or 'custom' to ensure they are not granting unintended group access. Audit group routes and key configurations to confirm strict containment rules are enforced.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79746. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart