جزئیات آسیب‌پذیری
CVE-2026-120323
samanhappy mcphub
samanhappy MCPHub passthroughHeaders.ts information disclosure
CVSS 4.0
5.3متوسط
نمای کلی
اکسپلویت‌های عمومی
اخبار مرتبط
خط زمانی
خلاصه‌ی فارسی
خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.
شرح رسمی (انگلیسی)
A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 5.3متوسط | 4.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X |
| 4.3متوسط | 3.1 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C |
| 4.3متوسط | 3.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C |
| 5.0متوسط | 2.0 | CVEProject cvelistV5 (CNA) (VulDB) | AV:N/AC:L/Au:N/C:P/I:N/A:N/E:ND/RL:OF/RC:C |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| samanhappy | mcphub | 1.0.0 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.1 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.10 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.11 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.12 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.13 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.14 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.15 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.16 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.17 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.18 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.19 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.2 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.20 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.21 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.22 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.23 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.24 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.25 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.26 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.27 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.28 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.29 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.3 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.30 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.31 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.32 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.33 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.34 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.35 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.36 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.37 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.38 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.39 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.4 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.40 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.41 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.42 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.43 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.44 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.45 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.5 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.6 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.7 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.8 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.0.9 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.1.0 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.1.1 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.1.2 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.1.3 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.1.4 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.1.5 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.1.6 | CVEProject cvelistV5 (CNA) |
| samanhappy | mcphub | 1.1.7 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۸- https://vuldb.com/vuln/429655 vdb-entrytechnical-description
- https://vuldb.com/vuln/429655/cti signaturepermissions-required
- https://vuldb.com/cve/CVE-2026-120323 third-party-advisory
- https://vuldb.com/submit/1015029 third-party-advisory
- https://github.com/samanhappy/mcphub/commit/040f7b9ae004070bdfe5084cde6bc2c609f78e76 patch
- https://github.com/samanhappy/mcphub/releases/tag/v1.1.8 patch
- https://github.com/samanhappy/mcphub/ product
- https://github.com/0xGenesi/CVE/blob/main/MCPHub_OpenAPI_passthroughHeaders_Credential_Exfiltration.md related
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۸/۱۱
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۸/۱۱
- وضعیت
- PUBLISHED
- صادرکننده (CNA)
- VulDB
- اولویت کلون
- به‌زودی
پیش‌بینی بهره‌برداری (EPSS)
۰٫۳۷٪
احتمال بهره‌برداری در ۳۰ روز
۳۱٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- Automatable
- no
- Exploitation
- poc
- Technical Impact
- partial
ضعف‌ها (CWE)
- CWE-200Information Disclosure
- CWE-284Improper Access Controls