Description
A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.
Published: 2026-11-02
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Information Disclosure
Action: Apply Patch
AI Analysis

Impact

A flaw in the passthroughHeaders function within the MCPHub project allows an attacker to manipulate header arguments and expose sensitive information. The issue results in disclosure of credentials or other confidential data through the response or logging mechanisms. The weakness is classified as information exposure and improper access control, which can compromise confidentiality.

Affected Systems

The vulnerability affects samanhappy MCPHub versions up to 1.0.45 and 1.1.7. No other versions are listed. The affected component is the source file src/utils/passthroughHeaders.ts.

Risk and Exploitability

The flaw is remotely exploitable and is rated with a CVSS score of 5.3. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the ability to craft requests to the server, indicating that exposed endpoints or unauthenticated access could be used to trigger the disclosure.

Generated by OpenCVE AI on November 2, 2026 at 03:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade MCPHub to version 1.1.8 or later using the fix identified by commit 040f7b9ae004070bdfe5084cde6bc2c609f78e76.
  • Restrict or remove the passthroughHeaders functionality from routes that do not require header forwarding to reduce attack surface.
  • Implement strict validation or whitelisting of header values passed to passthroughHeaders to prevent leakage of sensitive data.

Generated by OpenCVE AI on November 2, 2026 at 03:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 02:15:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.
Title samanhappy MCPHub passthroughHeaders.ts information disclosure
First Time appeared Samanhappy
Samanhappy mcphub
Weaknesses CWE-200
CWE-284
CPEs cpe:2.3:a:samanhappy:mcphub:*:*:*:*:*:*:*:*
Vendors & Products Samanhappy
Samanhappy mcphub
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:N/A:N/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Samanhappy Mcphub
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-02T02:00:22.478Z

Reserved: 2026-11-01T13:19:46.194Z

Link: CVE-2026-120323

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-02T02:18:47.757

Modified: 2026-11-02T02:18:47.933

Link: CVE-2026-120323

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-02T03:45:14Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control