What happened
MCPHub, an MCP orchestration hub that centrally manages and routes calls to multiple downstream MCP servers, allowed any authenticated non-admin user to register a malicious stdio MCP server configuration (e.g. /bin/sh) that MCPHub would immediately execute with no command allowlisting or authorization check, resulting in full remote code execution as the hub's OS user.
Why it matters
MCPHub sits at a privileged control point brokering access to many downstream AI tool servers; RCE here gives an attacker complete control of the orchestration layer and every credential/tool it can reach, collapsing the entire agentic tool-access boundary in one step. CVSS 9.9.
Attack vector
POST /api/servers and PUT /api/servers/:name create/update MCP server configs and immediately spawn the configured stdio process via child_process.spawn. No authorization check restricts this to admins, and no allowlist/sanitization exists on the command/args fields, so any authenticated non-admin user can submit command:"/bin/sh" with arbitrary args to execute code as the MCPHub server's OS user (often root).
Affected systems
MCPHub (samanhappy/mcphub) prior to 0.12.15
Mitigation
Upgrade to MCPHub 0.12.15 or later; restrict server-configuration endpoints to admin roles; run MCPHub as a non-root user.