---
id: "CVE-2026-120323"
kind: "vulnerability"
aliases: ["CVE-2026-120323"]
title: "MCPHub: header passthrough flaw can leak information to remote callers"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "mcp", "mcphub", "self-hosted"]
not_affected_if: ["local-only-use", "unknown"]
published_at: "2026-11-02T02:18:47+00:00"
first_seen_at: "2026-11-02T02:23:37+00:00"
updated_at: "2026-11-02T02:24:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120323", "first_seen_at": "2026-11-02T02:23:37+00:00"}]
---

# MCPHub: header passthrough flaw can leak information to remote callers

MCPHub is a gateway that runs MCP servers for AI tools. A flaw in how it passes request headers through (src/utils/passthroughHeaders.ts) lets a remote attacker disclose information.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed MCPHub version against the affected range `1.0.45` and `1.1.7` (up to and including).
- Look for `src/utils/passthroughHeaders.ts` in the deployed code; unknown whether the sources give a configuration that changes exposure.

## Fix

- Upgrade MCPHub to `1.1.8`, per the advisory; patch commit 040f7b9ae004070bdfe5084cde6bc2c609f78e76.

## Timeline

- 2026-11-02T02:23:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120323

## From the sources

A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_