A critical authorization vulnerability in MCPHub allows any authenticated user to execute arbitrary commands on the host operating system, leading to a complete compromise of the server.

The application fails to perform authorization checks on the POST /api/servers and PUT /api/servers/:name endpoints, allowing authenticated low-privilege users to spawn arbitrary child processes. Because these processes run with the privileges of the MCPHub service, which is often root, this results in full system compromise.

The potential impact of this vulnerability is total system compromise, allowing an attacker to gain persistent access, exfiltrate sensitive data, or disrupt business operations. With a CVSS score of 9.9, this flaw represents an extreme risk to confidentiality, integrity, and availability, particularly in environments where MCPHub is deployed with root privileges.

Immediate Action: Update the samanhappy mcphub installation to version 0.12.15 or later immediately to incorporate the required authorization checks.

Proactive Monitoring: Review application access logs for unusual POST or PUT requests to /api/servers and monitor for the spawning of unexpected child processes or shells by the MCPHub service.

Compensating Controls: Deploy a Web Application Firewall (WAF) to restrict access to the /api/servers endpoints to known administrative IP addresses or service accounts until the update can be applied.

Public Exploit Available: Unknown

Given the critical severity of this vulnerability and the ease with which it can be exploited by any authenticated user, immediate patching is mandatory. Organizations should prioritize upgrading to version 0.12.15 to prevent unauthorized code execution and potential full system takeover.