Vulnerabilità · 163 giorni fa

MCPHub Auth Bypass Lets Unauthenticated Users Act Privileged

MCPHub is treating some endpoints as trusted when they are not. In versions below 0.11.0, missing authentication middleware lets an unauthenticated user perform actions as other users and inherit their privileges.

CERT Polska says the flaw is CVE-2025-13822 and affects MCPHub below 0.11.0. The issue is an authentication bypass, not credential theft, so the danger is direct privilege abuse on exposed endpoints.

The risk persists anywhere MCPHub is deployed with those endpoints reachable. Fixing the version closes the gap, but any action already taken under another user’s identity still needs review.

Cronologia

• 20 apr Segnalato da The Hacker News
• 17 apr Segnalato da The Register Security
• 14 apr Segnalato da CERT Polska

Fonti

4 fonti che coprono questa storia

• The Hacker News 20 apr

  Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain

  MCP design flaw enables RCE across 7,000+ servers and 150M downloads, impacting AI SDKs and supply chains.

• The Register Security 17 apr

  MCP 'design flaw' puts 200k servers at risk: Researcher

  : Bug or feature?

• Infosecurity Magazine 16 apr

  Systemic Flaw in MCP Protocol Could Expose 150 Million Downloads

  Ox Security claims as many as 200,000 servers are exposed by newly discovered MCP vulnerability

• CERT Polska 14 apr

  Vulnerability in MCPHub software

  Authorization bypass vulnerability (CVE-2025-13822) has been found in MCPHub project.

Entità

• CVE-2025-13822

Part of the PlainSec briefing for 2026-04-20

Editions

• Briefing for 2026-04-20

Storie correlate

• Serial-to-IP Flaws Expose Legacy OT at Scale
• Single Verifier Let Lazarus Forge Cross-Chain Messages
• End-of-Life TP-Link Routers Face Botnet Infection Attempts