Description

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endpoints in MCPHub create/update MCP server configurations and then immediately spawn the configured stdio process via child_process.spawn. Authentication is required, but there is no authorization check restricting these endpoints to admins, and there is no allowlist/sanitization on the command and args fields. As a result, any authenticated non-admin user can submit a server configuration with command:"/bin/sh" (or any other binary) and arbitrary args, causing MCPHub to execute the attacker-controlled process as the MCPHub server's OS user (commonly root in the published Docker image and in npx/systemd deployments). This issue has been patched in version 0.12.15.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-31T18:17:20.340Z",
  "pubdate": "2026-08-31T18:17:20.340Z",
  "executiveSummary": "MCPHub prior to version 0.12.15 is susceptible to an Arbitrary OS Command Execution vulnerability due to improper input validation and missing authorization controls. The application allows authenticated users to configure MCP server endpoints without administrative restrictions. By submitting crafted server configurations via the POST /api/servers or PUT /api/servers/:name endpoints, an attacker can supply arbitrary binary paths and arguments that are subsequently executed by the application process. Because the application often runs with elevated privileges—such as root within its provided Docker environment—successful exploitation results in full system compromise. The vulnerability stems from the direct integration of user-supplied input into the child_process.spawn function without sanitization or an allowlist of permitted commands. This flaw represents a critical risk, as any authenticated user can achieve remote code execution, leading to unauthorized system access, data exfiltration, or complete host takeover. The impact is exacerbated by the lack of internal role-based access control (RBAC), meaning non-admin users effectively possess administrative execution capabilities.",
  "technicalDetails": "The vulnerability resides within the server management endpoints of the MCPHub application, specifically /api/servers and /api/servers/:name. The core issue is an improper control over the command execution lifecycle triggered by user-defined configuration payloads. Upon receiving a POST or PUT request, the application persists the provided configuration, which includes a command field and an accompanying arguments array. Critically, the backend logic proceeds to invoke child_process.spawn using these unvalidated inputs immediately after the configuration is committed to the registry.\nThe technical root cause is two-fold: an absence of authorization checks and a lack of input validation. While the endpoints are protected by authentication, they fail to verify whether the requester holds sufficient administrative privileges to define new server execution environments. Furthermore, there is no validation against an allowlist of binaries, nor is there any sanitization to prevent the injection of shell commands or arbitrary executable paths. An attacker with standard user credentials can submit a JSON payload containing a malicious 'command' (e.g., '/bin/sh', '/usr/bin/python3', or other system binaries) and arbitrary 'args'.\nThe exploitation flow follows a predictable sequence: First, the attacker authenticates to the MCPHub instance. Second, the attacker issues a malicious request to /api/servers, providing a configuration that instructs the underlying Node.js runtime to execute a binary of the attacker's choosing. Third, the application's internal handler parses this malicious input and invokes child_process.spawn. Finally, the operating system executes the specified process under the security context of the MCPHub server. Since the MCPHub process is frequently deployed with root privileges in standard Docker, npx, or systemd configurations, the attacker inherits the full permissions of the host's root user. This allows for persistent backdoors, data manipulation, or lateral movement within the network. Because the process is spawned immediately upon configuration, the exploitation is deterministic and does not require complex heap grooming or memory corruption techniques, making it trivial to execute."
}