{"data":{"id":"b3beca91-6938-48bc-ad51-3421e9693e51","title":"CVE-2026-79745: MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate…","summary":"MCPHub, a hub for managing and orchestrating multiple MCP servers and APIs, performs no role checking on its built-in prompt and resource controllers before version 1.0.32. Any authenticated non-admin user can call the mutating POST/PUT /api/prompts* and POST/PUT /api/resources* routes, creating, overwriting or shadowing global prompt templates and resources that are served to all users. Because these records are consulted before any connected MCP server, the tampering can also lead to prompt injection in other users' LLM sessions.","solution":"Fixed in 1.0.32.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79745","publishedAt":"2026-08-31T18:17:19.910Z","cveId":"CVE-2026-79745","cweIds":["CWE-862"],"cvssScore":"7.1","cvssSeverity":"high","severity":"high","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["MCPHub","MCP servers"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"MCPHub endpoints let non-admin users overwrite global records","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00439,"epssCheckedAt":"2026-11-05T18:10:03.196Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-01T18:08:51.582Z","patchAvailable":null,"disclosureDate":"2026-08-31T18:17:19.910Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","safety"],"aiComponentTargeted":"plugin","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[]}}