CVE-2026-120323mediumCWE-200CWE-284

CVE-2026-120323: fallo de gravedad media en samanhappy MCPHub

samanhappy MCPHub passthroughHeaders.ts information disclosure

Publicada el

Seguir esta CVE+ Monitorear mcphub

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.4%
A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
Productos afectados
samanhappy · MCPHub
CVEs relacionadas — samanhappy MCPHub

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-11285MEDIUMsamanhappy MCPHub serverController.ts os command injectionEPSS 7.9%CVE-2025-11287MEDIUMsamanhappy MCPHub sseService.ts handleSseConnectionfunction improper authenticationEPSS 0.6%CVE-2026-94047MEDIUMsamanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges managementEPSS 0.4%CVE-2025-11286MEDIUMsamanhappy MCPHub MCPRouter Service serverController.ts server-side request forgeryEPSS 0.3%