{"id":"CVE-2026-120323","kind":"vulnerability","aliases":["CVE-2026-120323"],"related":[],"title":"MCPHub: header passthrough flaw can leak information to remote callers","description":"A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.","summary":"MCPHub is a gateway that runs MCP servers for AI tools. A flaw in how it passes request headers through (src/utils/passthroughHeaders.ts) lets a remote attacker disclose information.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","mcp","mcphub","self-hosted"],"not_affected_if":["local-only-use","unknown"],"how_to_check":"- Check the installed MCPHub version against the affected range `1.0.45` and `1.1.7` (up to and including).\n- Look for `src/utils/passthroughHeaders.ts` in the deployed code; unknown whether the sources give a configuration that changes exposure.","fix":"- Upgrade MCPHub to `1.1.8`, per the advisory; patch commit 040f7b9ae004070bdfe5084cde6bc2c609f78e76.","status":"open","published_at":"2026-11-02T02:18:47+00:00","first_seen_at":"2026-11-02T02:23:37+00:00","triaged_at":"2026-11-02T02:24:30+00:00","updated_at":"2026-11-02T02:24:30+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-02T02:24:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MCPHub to `1.1.8`, per the advisory; patch commit 040f7b9ae004070bdfe5084cde6bc2c609f78e76.","reach":"internet","title":"MCPHub: header passthrough flaw can leak information to remote callers","impact":"low","summary":"MCPHub is a gateway that runs MCP servers for AI tools. A flaw in how it passes request headers through (src/utils/passthroughHeaders.ts) lets a remote attacker disclose information.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["mcp","mcphub","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Remote attacker reads information the gateway should keep private.","analyst_note":"Confirm which headers leak and whether auth is required; check the NVD entry and the 1.1.8 release notes.","how_to_check":"- Check the installed MCPHub version against the affected range `1.0.45` and `1.1.7` (up to and including).\n- Look for `src/utils/passthroughHeaders.ts` in the deployed code; unknown whether the sources give a configuration that changes exposure.","plain_action":"","needs_analyst":true,"not_affected_if":["local-only-use","unknown"],"who_is_affected":"Teams running MCPHub versions up to 1.0.45 or 1.1.7 that expose it over a network. The flaw sits in how header values are passed through, so exposure depends on whether the gateway is reachable by untrusted callers. Deployments kept local to a trusted machine are less exposed; unknown whether the sources name a specific configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000728,"input_tokens":4200,"output_tokens":617,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120323':13A,16A '-2026':12A,15A '/1.1.7':64C '040f7b9ae004070bdfe5084cde6bc2c609f78e76':105C '1.0.45':63C '1.1.8':93C 'address':97C 'advis':108C 'affect':112C 'ai':18B,34B 'ai-tool':17B 'argument':78C 'attack':49B,85C 'caller':10A 'compon':113C 'cve':11A,14A 'disclos':50B 'disclosur':83C 'discov':57C 'file':72C 'flaw':4A,37B,54C 'function':69C 'gateway':28B 'header':2A,43B 'host':24B 'identifi':103C 'impact':65C 'inform':7A,51B,82C 'issu':99C 'launch':88C 'leak':6A 'let':46B 'manipul':75C 'may':86C 'mcp':20B,31B 'mcphub':1A,21B,25B,60C 'pass':41B 'passthrough':3A 'passthroughhead':79C 'patch':101C 'recommend':95C 'remot':9A,48B,89C 'request':42B 'result':80C 'run':30B 'samanhappi':59C 'secur':53C 'self':23B 'self-host':22B 'server':32B 'src/utils/passthroughheaders.ts':45B,73C 'tool':19B,35B 'unknown':68C 'upgrad':90C,110C 'version':92C","nicknames":[],"mitigations":[],"who_affected":"Teams running MCPHub versions up to 1.0.45 or 1.1.7 that expose it over a network. The flaw sits in how header values are passed through, so exposure depends on whether the gateway is reachable by untrusted callers. Deployments kept local to a trusted machine are less exposed; unknown whether the sources name a specific configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","mcp","mcphub","medium","selfhosted"],"first_public_at":"2026-11-02T02:18:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120323","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120323","severity":null,"published_at":"2026-11-02T02:18:47+00:00","modified_at":"2026-11-02T02:18:47+00:00","first_seen_at":"2026-11-02T02:23:37+00:00","fetched_at":"2026-11-02T02:23:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}