CVE-2026-108699 hyper-mcp-rs CVE debrief

Who should care

Defenders responsible for hyper-mcp installations, developers using WebAssembly plugins, and security teams monitoring for potential exploitation attempts should be aware of this vulnerability.

Why it matters

CVE-2026-108699 is a high-severity vulnerability in hyper-mcp through 0.8.3 that allows attackers to load malicious WebAssembly plugins due to improper signature verification. Defenders should prioritize verifying hyper-mcp installations, reviewing plugin signatures, and updating to a fixed version if available.

• Potential execution of malicious plugins with host, filesystem, and environment capabilities
• Possible exploitation attempts require monitoring and verification of plugin signatures
• Verification of hyper-mcp installations and plugin signatures is necessary

Technical summary

The hyper-mcp package through version 0.8.3 contains an improper signature verification vulnerability. This allows attackers to load malicious WebAssembly plugins by default accepting any signer identity and OIDC issuer. Attackers controlling a plugin image reference can sign a malicious image with a free Sigstore keyless certificate to execute plugins with configured host, filesystem, and environment capabilities.

Defensive priority

Defenders should prioritize verifying hyper-mcp installations, reviewing plugin signatures, and updating to a fixed version if available.

Recommended defensive actions

• Verify hyper-mcp installations and review plugin signatures
• Update to a fixed version if available
• Monitor for potential exploitation attempts
• Perform vulnerability scanning to identify exposed systems
• Implement compensating controls for exposed systems
• Review and update asset inventory to ensure accurate tracking
• Establish a rollback plan for affected systems

Evidence notes

The CVE record and source item provide details on the improper signature verification vulnerability in hyper-mcp through 0.8.3. However, limited information is available on potential exploits or impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.