MCPHub Missing Authorization on System Config Endpoint
First seen Sep 1, 2026 · Updated Sep 1, 2026 · CVSS 8.8
MCPHub, a centralized hub for orchestrating multiple MCP servers, contained a broken access control flaw where any authenticated user could modify system-wide configuration via the PUT /api/system-config endpoint, since the handler never checked admin privileges. This allows a low-privileged user to reconfigure routing to MCP servers, potentially redirecting agent traffic, disabling security controls, or hijacking tool orchestration across the hub. The issue is fixed in version 1.0.29.
Technical Analysis
The updateSystemConfig handler behind PUT /api/system-config relied solely on generic authentication middleware and rate limiting, but never validated req.user.isAdmin before applying changes. Any authenticated, non-admin user could therefore submit crafted requests to alter global system configuration governing how multiple MCP servers/APIs are routed and orchestrated. Because MCPHub centrally brokers connections between agents and downstream MCP servers, an attacker exploiting this could repoint routing rules to attacker-controlled or malicious MCP endpoints, effectively performing a man-in-the-middle on agent-to-tool traffic or disabling security-relevant settings. This crosses a trust boundary from a low-privilege application user to full administrative control over the orchestration layer, impacting every agent and tool session routed through the hub.
Affected Systems
MCPHub; protocols: MCP
Detection Signatures
- PUT /api/system-config requests from non-admin user sessions
- Audit logs showing system-config changes without corresponding admin role in req.user
- Unexpected changes to MCP server routing/endpoint definitions outside change-management windows
- API access logs showing config-modifying calls succeeding despite isAdmin=false
Remediation Steps
- 1
Upgrade MCPHub
Update to MCPHub version 1.0.29 or later, which enforces proper admin authorization on the system-config endpoint.
- 2
Enforce server-side authorization checks
Ensure all privileged endpoints validate req.user.isAdmin (or equivalent role/claim) server-side, not relying on client assumptions or UI-level restrictions.
- 3
Audit configuration history
Review system-config change logs for unauthorized modifications, especially routing changes to unfamiliar MCP server endpoints, since the vulnerability was introduced.
- 4
Apply least privilege and monitoring
Restrict who can authenticate to MCPHub, add alerting on system-config changes, and monitor for newly added or altered MCP server routes.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.