CVE-2026-79746 samanhappy CVE debrief

Who should care

Defenders responsible for managing MCPHub configurations, especially those using bearer keys with accessType: 'servers' or 'custom', should assess their exposure and verify that all servers within a group are properly authorized.

Why it matters

Defenders should prioritize verifying their MCPHub configurations, especially those using bearer keys with accessType: 'servers' or 'custom', to prevent unauthorized access to sensitive servers within a group. The vulnerability allows access to the entire group if any single server in that group appears in the key's allowedServers list, rather than requiring a match for every server the key is scoped to. This issue has been patched in version 1.0.31.

• Potential unauthorized access to sensitive servers within a group
• Possible lateral movement within the group if an attacker gains access to one server
• Need for verification of MCPHub configurations to ensure proper authorization
• Requirement for updating to version 1.0.31 or later to patch the vulnerability

Technical summary

The vulnerability in MCPHub allows unauthorized access to servers within a group when using a bearer key with accessType: 'servers' or 'custom'. This is due to the isBearerKeyAllowedForRequest function granting access to the entire group if any single server in that group appears in the key's allowedServers list, rather than requiring a match for every server the key is scoped to. Affected product deployments should be verified for exposure, and defenders should prioritize verifying their MCPHub configurations, especially those using bearer keys with accessType: 'servers' or 'custom', to prevent unauthorized access to sensitive servers within a group. The issue has been patched in version 1.0.31, and updating

Defensive priority

Defenders should prioritize verifying their MCPHub configurations, especially those using bearer keys with accessType: 'servers' or 'custom', and ensure that all servers within a group are properly authorized.

Recommended defensive actions

• Verify MCPHub configurations for proper authorization of servers within groups
• Ensure all servers within a group are properly authorized when using bearer keys with accessType: 'servers' or 'custom'
• Update to version 1.0.31 or later to patch the vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, its impact, and the patched version. However, further verification is required to determine the full scope of affected systems and to confirm the effectiveness of the patch.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.