The vulnerability allows an attacker who can influence the plugin image reference to sign a malicious WebAssembly image with a free Sigstore keyless certificate. Because cosign_verify_args() accepts any signer identity and OIDC issuer by default, the plugin is loaded and executed with the configured host, filesystem, and environment capabilities. This results in the attacker gaining the ability to read, modify, or delete host files and execute arbitrary code within the hyper‑mcp process, effectively compromising confidentiality, integrity, and potentially availability of the host system. The weakness is a classic improper signature verification flaw (CWE-347).

The affected product is hyper‑mcp by hyper‑mcp‑rs. All releases up to and including version 0.8.3 are vulnerable. No other vendors or versions are listed.

The vulnerability carries a CVSS score of 8.3, indicating high severity. EPSS data is not available, so the exact exploitation probability cannot be quantified, but the lack of a KEV listing does not diminish the potential impact; the flaw is actively exploitable in any environment where an attacker can supply a plugin image reference. The likely attack vector is remote through the configuration of plugin image references or registry access, as the attacker only needs to control the image that hyper‑mcp pulls. Given the ability to sign malicious images with a free keyless certificate, exploitation is relatively straightforward for an attacker with access to the image registry workflow.