Live › vulnerability › CVE-2026-120323
MCPHub is a gateway that runs MCP servers for AI tools. A flaw in how it passes request headers through (src/utils/passthroughHeaders.ts) lets a remote attacker disclose information.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 02:23 UTC. All times on this page are UTC.
Teams running MCPHub versions up to 1.0.45 or 1.1.7 that expose it over a network. The flaw sits in how header values are passed through, so exposure depends on whether the gateway is reachable by untrusted callers. Deployments kept local to a trusted machine are less exposed; unknown whether the sources name a specific configuration.
No product ranges from the sources yet.
1.0.45 and 1.1.7 (up to and including).src/utils/passthroughHeaders.ts in the deployed code; unknown whether the sources give a configuration that changes exposure.1.1.8, per the advisory; patch commit 040f7b9ae004070bdfe5084cde6bc2c609f78e76.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.
This page as .md · .json · in your agent: get_signal("CVE-2026-120323")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.