Log in Start free

Vulnerability · Published Nov 2, 2026 · Assigned by VulDB

CVE-2026-120323samanhappy MCPHub passthroughHeaders.ts information disclosure

Medium 4.3

In plain English

A medium-severity information exposure in MCPHub from samanhappy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.4%top 68.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.

Affected products (as reported)

VendorProductVersions
samanhappy MCPHub 1.0.01.0.11.0.21.0.31.0.41.0.51.0.61.0.7

Weakness: CWE-200, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C

References