The vulnerability arises when MCPHub processes the POST /api/servers and PUT /api/servers/:name endpoints. They create or update server configurations and immediately spawn the declared stdio process via child_process.spawn. Although authentication is required, there is no authorization check to restrict these actions to administrators, and the command and args fields are not sanitized or allowed‑listed. Consequently, any authenticated user can submit a configuration that specifies a command such as /bin/sh with arbitrary arguments, causing the MCPHub service to execute that command under the OS user running the service, which in many deployments is root. This results in remote code execution, allowing the attacker to run arbitrary code, obtain full system privileges, and compromise the host.

Systems impacted are installations of samanhappy:mcphub prior to version 0.12.15. This includes the Docker image distributed by the project and any npx or systemd deployments that use the published image. The vulnerability exists in versions earlier than 0.12.15; version 0.12.15 and later contain the fix that enforces admin‑only access and validates the command and args fields.

The CVSS score is 9.9, indicating critical severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, but the lack of an authorization boundary in a web API that can be invoked by any authenticated user means that exploitation is straightforward for anyone who can obtain valid credentials. Once the attacker composes a suitable configuration payload, the server will spawn the attacker‑controlled process as the MCPHub OS user, often root, providing full control of the host. Given the high severity and the ease of construction of the exploit payload, the risk is considerable for all environments that expose these API endpoints.