CVE-2026-79748: MCPHub MCP Server Management Platform Config Injection RCE, CVSS 9.9
MCPHub versions prior to 0.12.15 contain critical config injection CVE-2026-79748. Attackers inject malicious config for RCE. AI infrastructure supply-chain risk is rising.
CVE-2026-79748 puts AI infrastructure back in scope: MCP server management and orchestration platform MCPHub, versions prior to 0.12.15, has a CVSS 9.9 config injection flaw. Attackers inject malicious configuration via the server config endpoint and achieve RCE on the host.
Incident Overview
MCPHub unifies management and orchestration of multiple MCP (Model Context Protocol) servers and APIs. As the AI Agent ecosystem scales, more enterprises use it to onboard and manage MCP services. The bug is in the server config endpoint: submitted config is insufficiently validated; injected malicious config yields arbitrary code execution. All versions prior to 0.12.15 are affected.
Technical Details
Root cause is a config-injection-to-code-execution chain. The config endpoint accepts attacker-controlled input, persists it, and the runtime interprets the malicious config — RCE. MCP servers typically hold high-value credentials (API keys, database connection strings). Compromise of the MCPHub host lets an attacker steal configs and credentials for all managed MCP servers and pivot into the rest of the enterprise AI stack.
Impact Assessment
CVSS 9.9 (Critical). In-the-wild exploitation is not confirmed. Two factors keep risk high: enterprise MCP adoption is growing fast, expanding exposure; the injection path is straightforward and low-barrier, so public exploit code is a matter of time. For organizations running AI Agents, this is supply-chain risk — the attack surface is the AI orchestration layer, not the business apps.
Remediation
- Upgrade MCPHub to 0.12.15 or later immediately.
- Do not expose MCPHub management endpoints to the public internet. Restrict them to the management network or localhost, behind an authenticated proxy.
- Audit managed MCP server config history and host logs for anomalous config changes and suspicious processes.
- Rotate API keys and connection credentials held by the platform. Enforce least privilege.
References
- Enigma Global daily threat intel digest (2026-09-02)