CVE-2025-11286
📋 TL;DR
This vulnerability allows remote attackers to perform server-side request forgery (SSRF) attacks against samanhappy MCPHub installations up to version 0.9.10. By manipulating the baseUrl argument in the MCPRouter Service component, attackers can make the vulnerable server send requests to internal systems. This affects all users running vulnerable versions of MCPHub.
💻 Affected Systems
- samanhappy MCPHub
📦 What is this software?
Mcphub by Mcphubx
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data, or pivot to other internal systems by exploiting the vulnerable server as a proxy.
Likely Case
Attackers scan for and exploit vulnerable instances to probe internal networks, potentially accessing metadata services or internal APIs.
If Mitigated
With proper network segmentation and input validation, impact is limited to the vulnerable server itself.
🎯 Exploit Status
Exploit details publicly disclosed on GitHub; vendor unresponsive to disclosure
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: unknown
Vendor Advisory: none
Restart Required: No
Instructions:
No official patch available. Consider upgrading if vendor releases fix, or implement workarounds.
🔧 Temporary Workarounds
Input Validation for baseUrl
allImplement strict validation to only allow trusted URLs in the baseUrl parameter
Network Segmentation
allRestrict outbound network access from the MCPHub server to only necessary destinations
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SSRF patterns
- Monitor for unusual outbound connections from the MCPHub server
🔍 How to Verify
Check if Vulnerable:
Check MCPHub version; if ≤0.9.10, assume vulnerableCheck Version:
Check package.json or application logs for version informationVerify Fix Applied:
Test if baseUrl parameter can trigger requests to internal IPs (e.g., 127.0.0.1, 169.254.169.254)📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from MCPHub to internal IPs
- baseUrl parameter containing internal addresses
Network Indicators:
- MCPHub server making requests to metadata services (169.254.169.254) or internal endpoints
SIEM Query:
source_ip=MCPHub_server AND dest_ip IN (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254)