MCPHub Missing Authorization Leads to Global Prompt/Resource Shadowing and Stored Prompt Injection

Technical Analysis

The vulnerability stems from missing role-based access control (RBAC) on the mutating POST/PUT /api/prompts* and /api/resources* routes: these routes are attached to the authenticated router but never inspect req.user to verify admin privileges, so any logged-in user can call them. The handlers write to global DAO singletons that back handleGetPromptRequest and handleReadResourceRequest, and these DAO records take precedence over data returned by connected upstream MCP servers. An attacker with a low-privilege account can therefore inject or overwrite globally-shared prompt templates or resource content, which is then served to every other user's LLM session as trusted context, effectively achieving stored prompt injection across tenant boundaries. This crosses the trust boundary between individual user sessions and the shared MCP orchestration layer, turning a broken-access-control bug into a multi-user prompt injection primitive.

Affected Systems

MCPHub; protocols: MCP

Detection Signatures

• Unexpected POST/PUT requests to /api/prompts* or /api/resources* from non-admin user tokens
• Log entries showing prompt/resource writes without corresponding admin role claims in req.user
• Discrepancies between DAO-stored prompt/resource content and content expected from the connected upstream MCP server
• Sudden unexplained changes to globally shared prompt templates or resource definitions
• Multiple distinct user sessions receiving identical, recently modified prompt content not tied to their own requests

Remediation Steps

1. 1

   Upgrade MCPHub

   Update to MCPHub version 1.0.32 or later, which adds proper admin role checks to prompt and resource management routes.

2. 2

   Enforce RBAC on all mutating endpoints

   Audit all POST/PUT/DELETE routes on the authenticated router to ensure req.user role is checked server-side before any write to shared/global state.

3. 3

   Isolate per-tenant prompt/resource stores

   Where possible, avoid globally-shared DAO singletons for prompt/resource content; scope storage per user or per workspace to limit blast radius.

4. 4

   Add integrity monitoring

   Implement change-detection/alerting on global prompt and resource records to catch unauthorized tampering quickly.

5. 5

   Review upstream MCP server precedence logic

   Reconsider whether locally stored DAO records should take precedence over live upstream MCP server responses, or require signed/verified content for override.