CVE-2025-11287 is a high severity (7.3) improper authentication flaw in samanhappy MCPHub up to 0.9.10. The handleSseConnection function in src/services/sseService.ts is affected. The record lists no fixed version, so keep MCPHub off untrusted networks and put authentication in front of it.
What's affected
The record lists samanhappy MCPHub up to and including 0.9.10. The affected function is handleSseConnection in src/services/sseService.ts. CVSS 7.3 (high severity), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
Fixed versions: none are named. The record says the vendor was contacted early and did not respond.
How to check if you're exposed
Work out where MCPHub runs and who can reach it. Check the version in your install or container tag against 0.9.10. Then test reachability from a network that should not have access, for example from a laptop outside the office or VPN.
Review reverse proxy and application logs for connections to the SSE endpoint from addresses you do not recognise. Also list which MCP servers your hub fronts, because anyone who connects may inherit access to their tools.
A dependency scan helps with the inventory part. The free in-browser scan at gold.safeguard.sh/scan lists the libraries in a manifest you paste in. It will not find a hobby PHP application that was never packaged, so keep a plain list of what you host too.
What to do now
- Keep MCPHub off untrusted networks. Bind it to localhost or a private interface.
- Put an authenticating reverse proxy or VPN in front of the SSE endpoint.
- Check the project repository for a release newer than 0.9.10. The record names none.
- Review which MCP servers and tools the hub exposes, and remove any that hold secrets or write access you do not need.
- Check logs for unexpected connections to the hub.
Why it matters
The record classes this as CWE-287 (improper authentication). The connection handler for server sent events does not properly confirm who is connecting.
MCP hubs gather tools for AI agents behind one endpoint. If the hub itself is open, whoever connects can inherit whatever those tools can do. The record says exploit details are public and the vendor did not respond. It is not on CISA KEV in the record.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a fixed MCPHub version?
The record names none for versions up to 0.9.10. Check the repository for newer releases and keep the service private.
Why do MCP hubs deserve extra care?
They gather tools for agents behind one endpoint, so access to the hub can mean access to everything behind it.
Sources
Last reviewed: 19 October 2026.
