samanhappy MCPHub passthroughHeaders.ts information disclosure
MCPHub up to v1.1.0 is exposed when an OpenAPI-type MCP server has openapi.passthroughHeaders listing authentication headers such as Authorization. CVSS scores it 5.3 (medium).
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- Proof of concept public, per CISA
- Fix
- Fix or patch referenced
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. MCPHub OpenAPI-type MCP server with openapi.passthroughHeaders configured Affected versions up to v1.1.0 (verified on v1.0.45)
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 32/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: partial
Summary
samanhappy MCPHub, an open-source tool for managing Model Context Protocol servers, is affected through its header-passthrough handling code. A remote attacker could potentially manipulate that handling to access information that should not be exposed.
Read the original description
A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.
What to do
Check whether your setup matches what the bug needs.
MCPHub OpenAPI-type MCP server with openapi.passthroughHeaders configured Affected versions up to v1.1.0 (verified on v1.0.45)Apply the patch listed under Evidence.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- samanhappy MCPHub
1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0.16, 1.0.17, 1.0.18, 1.0.19, 1.0.20, 1.0.21, 1.0.22, 1.0.23, 1.0.24, 1.0.25, 1.0.26, 1.0.27, 1.0.28, 1.0.29, and 24 more
Evidence 8
- Advisory
- Advisory
- Advisory
- Advisory
- Patch
Show all 8 sourcesShow fewer sources
- Patch
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-120323
What does this mean?
The passthroughHeaders.ts code forwards authentication headers such as Authorization to an OpenAPI-type MCP server configured with openapi.passthroughHeaders. A low-privileged user who controls such a server can silently collect the session credentials of users who invoke its tools, including an administrator's Bearer key and session cookie.Source: github.com
Am I affected, and how do I check?
Versions up to v1.1.0 are affected, verified on v1.0.45; the v1.1.0 code diff adds no header denylist. The setup involves an OpenAPI-type MCP server whose openapi.passthroughHeaders list includes headers such as Authorization. Check the installed MCPHub version and review that list in each OpenAPI-type server's configuration.Source: github.com
What should I do about it?
The checked facts do not name a fixed release, so no upgrade target can be given. Because v1.1.0 is still listed as affected, do not treat that version as a fix.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.Source: cve.now feed data