CVE-2026-120323mediumCWE-200CWE-284

CVE-2026-120323: medium-severity vulnerability in samanhappy MCPHub

samanhappy MCPHub passthroughHeaders.ts information disclosure

Published

Follow this CVE+ Monitor mcphub

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.4%
A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
Affected products
samanhappy · MCPHub
Related CVEs — samanhappy MCPHub

In the same product, most dangerous first.

CVE-2025-11285MEDIUMsamanhappy MCPHub serverController.ts os command injectionEPSS 7.9%CVE-2025-11287MEDIUMsamanhappy MCPHub sseService.ts handleSseConnectionfunction improper authenticationEPSS 0.6%CVE-2026-94047MEDIUMsamanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges managementEPSS 0.4%CVE-2025-11286MEDIUMsamanhappy MCPHub MCPRouter Service serverController.ts server-side request forgeryEPSS 0.3%