---
id: CVE-2026-120323
title: samanhappy MCPHub passthroughHeaders.ts information disclosure
summary: >-
  A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7.
  Impacted is an unknown function of the file src/utils/passthroughHeaders.ts.
  The manipulation of the argument passthroughHeaders results in information
  disclosu…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-200
  - CWE-284
vendor: samanhappy
product: MCPHub
affected:
  - MCPHub 1.0.0
  - MCPHub 1.0.1
  - MCPHub 1.0.2
  - MCPHub 1.0.3
  - MCPHub 1.0.4
  - MCPHub 1.0.5
  - MCPHub 1.0.6
  - MCPHub 1.0.7
  - MCPHub 1.0.8
  - MCPHub 1.0.9
  - MCPHub 1.0.10
  - MCPHub 1.0.11
  - MCPHub 1.0.12
  - MCPHub 1.0.13
  - MCPHub 1.0.14
  - MCPHub 1.0.15
  - MCPHub 1.0.16
  - MCPHub 1.0.17
  - MCPHub 1.0.18
  - MCPHub 1.0.19
  - MCPHub 1.0.20
  - MCPHub 1.0.21
  - MCPHub 1.0.22
  - MCPHub 1.0.23
  - MCPHub 1.0.24
  - MCPHub 1.0.25
  - MCPHub 1.0.26
  - MCPHub 1.0.27
  - MCPHub 1.0.28
  - MCPHub 1.0.29
  - MCPHub 1.0.30
  - MCPHub 1.0.31
  - MCPHub 1.0.32
  - MCPHub 1.0.33
  - MCPHub 1.0.34
  - MCPHub 1.0.35
  - MCPHub 1.0.36
  - MCPHub 1.0.37
  - MCPHub 1.0.38
  - MCPHub 1.0.39
  - MCPHub 1.0.40
  - MCPHub 1.0.41
  - MCPHub 1.0.42
  - MCPHub 1.0.43
  - MCPHub 1.0.44
  - MCPHub 1.0.45
  - MCPHub 1.1.0
  - MCPHub 1.1.1
  - MCPHub 1.1.2
  - MCPHub 1.1.3
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T14:22:43.150982Z'
exploitAvailable: true
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T14:23:13.148Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120323'
references:
  - url: 'https://vuldb.com/vuln/429655'
    label: >-
      VDB-429655 | samanhappy MCPHub passthroughHeaders.ts information
      disclosure
  - url: 'https://vuldb.com/vuln/429655/cti'
    label: 'VDB-429655 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-120323'
    label: CVE-2026-120323 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1015029'
    label: >-
      Submit #1015029 | samanhappy MCPHub v1.0.45 information disclosure /
      credential theft
  - url: >-
      https://github.com/0xGenesi/CVE/blob/main/MCPHub_OpenAPI_passthroughHeaders_Credential_Exfiltration.md
  - url: >-
      https://github.com/samanhappy/mcphub/commit/040f7b9ae004070bdfe5084cde6bc2c609f78e76
  - url: 'https://github.com/samanhappy/mcphub/releases/tag/v1.1.8'
  - url: 'https://github.com/samanhappy/mcphub/'
tags:
  - cve.org
  - exploit-available
epss: 0.00371
epssPercentile: 0.31199
ingestedAt: '2026-11-05T19:30:42.650Z'
---

## Overview

A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.

## Affected

- `MCPHub 1.0.0`
- `MCPHub 1.0.1`
- `MCPHub 1.0.2`
- `MCPHub 1.0.3`
- `MCPHub 1.0.4`
- `MCPHub 1.0.5`
- `MCPHub 1.0.6`
- `MCPHub 1.0.7`
- `MCPHub 1.0.8`
- `MCPHub 1.0.9`
- `MCPHub 1.0.10`
- `MCPHub 1.0.11`
- `MCPHub 1.0.12`
- `MCPHub 1.0.13`
- `MCPHub 1.0.14`
- `MCPHub 1.0.15`
- `MCPHub 1.0.16`
- `MCPHub 1.0.17`
- `MCPHub 1.0.18`
- `MCPHub 1.0.19`
- `MCPHub 1.0.20`
- `MCPHub 1.0.21`
- `MCPHub 1.0.22`
- `MCPHub 1.0.23`
- `MCPHub 1.0.24`
- `MCPHub 1.0.25`
- `MCPHub 1.0.26`
- `MCPHub 1.0.27`
- `MCPHub 1.0.28`
- `MCPHub 1.0.29`
- `MCPHub 1.0.30`
- `MCPHub 1.0.31`
- `MCPHub 1.0.32`
- `MCPHub 1.0.33`
- `MCPHub 1.0.34`
- `MCPHub 1.0.35`
- `MCPHub 1.0.36`
- `MCPHub 1.0.37`
- `MCPHub 1.0.38`
- `MCPHub 1.0.39`
- `MCPHub 1.0.40`
- `MCPHub 1.0.41`
- `MCPHub 1.0.42`
- `MCPHub 1.0.43`
- `MCPHub 1.0.44`
- `MCPHub 1.0.45`
- `MCPHub 1.1.0`
- `MCPHub 1.1.1`
- `MCPHub 1.1.2`
- `MCPHub 1.1.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.