MCPHub Authorization Failures Let Any Logged-In User Execute Commands as Root and Reach Other Tenants' MCP Servers (CVE-2026-79748, CVE-2026-79750, CVE-2026-79746)

MCPHub (`@samanhappy/mcphub`), a hub that centrally manages and orchestrates multiple MCP servers behind routed endpoints

Three authorization flaws were published on August 31, 2026. CVE-2026-79748 (CVSS 9.9) is missing authorization on `POST /api/servers` and `PUT /api/servers/:name`: any authenticated non-admin user can submit a server configuration carrying an arbitrary `command` and `args`, and MCPHub launches that process as its own OS user, which is root in the published Docker image and in common npx and systemd deployments. CVE-2026-79750 (CWE-639) lets any authenticated non-admin invoke tools on MCP servers owned by other users, including servers they cannot see in the interface; because connected servers carry real capability such as filesystem access, HTTP fetch, and cloud APIs holding the owner's keys, the researchers demonstrated arbitrary host file read and server-side request forgery across tenants. CVE-2026-79746 (CVSS 8.1, CWE-863) is a scope-widening bug in `isBearerKeyAllowedForRequest`: a bearer key with `accessType: 'servers'` used against a group route grants access to every server in that group as long as a single server in the group appears in the key's `allowedServers` list. Fixes landed in 0.12.15, 1.0.30, and 1.0.31 respectively

An aggregation layer that concentrates many MCP servers, and therefore many sets of credentials and capabilities, behind one authenticated surface, while treating "authenticated" as equivalent to "authorized." Server registration accepts an executable command from ordinary users, tool invocation never checks ownership, and key scoping is evaluated with an any-match rather than an all-match test