Hyper‑mcp up to version 0.8.3 verifies the Cosign signature of a tag that has been resolved separately from the manifest that is actually loaded. This loosely‑coupled verification means an attacker who can influence registry responses for the signature tag can serve a signed, trusted signature while simultaneously delivering an unsigned malicious WebAssembly manifest to the loader. The loader trusts the signature and executes the unsigned plugin with whatever host capabilities it is configured to provide. The flaw is a TOCTOU race condition (CWE‑367) that allows unauthorized code execution.

The vulnerability affects the hyper‑mcp-rs hyper‑mcp project, specifically all releases up to and including 0.8.3. No other products are listed as affected.

With a CVSS score of 8.3 the vulnerability is considered high severity. Although an EPSS score is not available and the issue is not in the CISA KEV catalog, the attack vector is inferred to be remote: an adversary controlling registry responses can succeed. Successful exploitation results in execution of arbitrary WebAssembly code with the host’s configured capabilities, giving the attacker broad control over the hyper‑mcp environment.