Database/AI/ML frameworks & serving
MCPHub: any authenticated user can register an MCP server and run arbitrary commands as the service user
Impact
MCPHub spawns the stdio process named in a server configuration immediately after the config is created or updated, and the create/update endpoints only check that the caller is authenticated - not that they are an admin. Any account on the hub can submit a config with command "/bin/sh" and arbitrary args and get command execution as the MCPHub OS user, which is root in the published Docker image and in typical npx/systemd deployments. On a fleet where MCPHub is the shared gateway that fronts agent tooling for many teams, one low-privilege account becomes root on the host running the hub, along with every credential and MCP server token that host holds. The advisory's CVSS reflects a scope change, i.e. the blast radius is not confined to the hub process.
Who can reach it
Any user with valid MCPHub credentials who can reach the HTTP API. Authentication is required; no admin role or other privilege is needed.
What to do
Upgrade to MCPHub 0.12.15 or later and restart the service - a container image bump and pod restart, no node drain. Until then, restrict network reach to the hub to trusted operators and cut back the accounts that hold hub credentials; there is no configuration flag in the advisory that disables the spawn path. Because the process commonly runs as root, treat any hub that had untrusted accounts as potentially compromised and rotate the tokens it stored.
References
Related entries
- scikit-learn / joblib: `joblib.load()` executes commands from an untrusted file via `__reduce__`CVE-2020-13092 · scikit-learn / joblibCritical
- PyTorch (`torch.jit.annotations.parse_type_line`): Arbitrary code execution via unsafe `eval` in TorchScript typeCVE-2022-45907 · PyTorch (`torch.jit.annotations.parse_type_line`)Critical
- MLflow: Path traversal prior to 2.3.1CVE-2023-2780 · MLflowCritical
- LangChain (`LLMMathChain`): Prompt injectionCVE-2023-29374 · LangChain (`LLMMathChain`)Critical
- LangChain (PALChain): Arbitrary code execution via `os.system`/`exec` in generated codeCVE-2023-36258 · LangChain (PALChain)Critical
- LangChain (`load_prompt`): Arbitrary code execution from a JSON prompt fileCVE-2023-36281 · LangChain (`load_prompt`)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.