What happened
Alongside the critical RCE (CVE-2026-79748), MCPHub's Aug 31 disclosure included seven additional High/Medium severity authorization-bypass and SSRF vulnerabilities spanning system configuration, group-key scoping, tool execution, prompt/resource APIs, and an incomplete IPv6 SSRF guard — indicating systemic authorization-design gaps across the whole product surface.
Why it matters
MCPHub concentrates access to many downstream MCP tool servers; this cluster shows the product's authorization model was broken end-to-end (not just one endpoint), letting low-privileged or external users escalate to cross-tenant tool access, SSRF into internal networks, or config tampering across an AI agent tool-routing layer.
Attack vector
Multiple distinct flaws disclosed the same day: unauthenticated system-config changes (CVE-2026-79744), group-scoped bearer keys granting cross-server access beyond their intended scope (CVE-2026-79746), non-admin tool-execution APIs bypassing server-ownership scoping (CVE-2026-79750), an IPv6-incomplete SSRF guard (CVE-2026-79749), unrestricted prompt/resource mutation endpoints (CVE-2026-79745), attacker-registrable arbitrary-URL servers causing hub-issued SSRF (CVE-2026-79747), and a malicious MCPB manifest-name path issue (CVE-2026-79743).
Affected systems
MCPHub (samanhappy/mcphub) — CVE-2026-79744 (<1.0.29), CVE-2026-79746 (<1.0.31), CVE-2026-79750 (<1.0.30), CVE-2026-79749 (<1.0.32), CVE-2026-79745 (<1.0.32), CVE-2026-79747 (<1.0.32), CVE-2026-79743 (<0.12.13)
Mitigation
Upgrade to the respective patched MCPHub releases (1.0.29 through 1.0.32 depending on CVE); audit bearer-key scoping and SSRF egress rules.