A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32. The impacted element is the function importTemplate of the file src/services/templateService.ts of the component Template Import Endpoint. The manipulation leads to improper privilege management. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Upgrading to version 1.0.33 is sufficient to resolve this issue. The identifier of the patch is 18a4467bc4ec6390b1f841d8a468a37e9922f837. It is advisable to upgrade the affected component.
CVE-2026-94047
MEDIUMPre-NVD 6.36.3—Trending — 5 sources updated this week
EchelonGraph scoreHIGH confidence
Score 6.3 from GitHub Security Advisory (severity: LOW) published 2026-09-20. a secondary CVSS source baseline 6.3; sources differ by 0.0.
Triggered by: GitHub Security Advisory CVSS
Sources: ghsa, secondary
6.3EG
EchelonGraph verdictMonitorLow exploitation likelihood right now — keep watching.
- Lower severity and no public exploit yet
CISA-KEV: Not listedEPSS PROB: 0%CVSS: 6.3Exploit: None knownExposed: 0
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
- CVSS v3
- 6.3
- EG Score
- 6.3(high)
- EG Risk
- 33(Track)EG Risk 33/100SSVC: Track
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity63% × 45%Exploitation0% × 40%Automatability30% × 15%Action: Routine — remediate on your standard cadence. - EPSS PROB
- 0%
- EPSS %ILE
- 35%
- KEV
- Not listed
Published
September 20, 2026
Last Modified
September 21, 2026
Advisory Details (5)
Auto-updated Sep 20, 2026🔬 Proof of concept available. Patch available. Sources: github_pr, github_commit, github_release.
generic
GitHub - samanhappy/mcphub: Self-hosted MCP gateway and control plane for connecting, controlling, and operating MCP servers. · GitHub
https://github.com/samanhappy/mcphub/github_release Patch Available
v1.0.33
Patch available: samanhappy/mcphub v1.0.33
https://github.com/samanhappy/mcphub/releases/tag/v1.0.33github_commit Patch Available
commit 18a4467bc4ec (samanhappy/mcphub)
Patch available: samanhappy/mcphub v1.0.33 (contains commit 18a4467bc4ec)
https://github.com/samanhappy/mcphub/commit/18a4467bc4ec6390b1f841d8a468a37e9922f837github_pr Patch Available
fix(security): enforce privileged config check on template import
Patch available: samanhappy/mcphub v1.0.33 (PR #1096 merged 2026-08-28)
https://github.com/samanhappy/mcphub/pull/1096generic🟡 PoC Available
[Security] Privilege escalation via template import allows low-privileged users to create stdio servers and achieve RCE · Issue #1094 · samanhappy/mcphub · GitHub
https://github.com/samanhappy/mcphub/issues/1094Vendor Advisories for CVE-2026-94047(1)
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
Weakness Classification(2)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Data Freshness Timeline
(refreshed 7× in last 7d / 7× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
- 2026-09-21 21:09 UTCEPSS rescore
- 2026-09-21 13:40 UTCEG score recompute
- 2026-09-21 13:40 UTCGHSA enrichment
- 2026-09-20 20:23 UTCEG score recompute
- 2026-09-20 20:23 UTCNVD updateCVSS v4 → 2.1
- 2026-09-20 19:16 UTCEG score recompute
- 2026-09-20 19:16 UTCMITRE cvelistV5first tracked
Related CVEs(same CWE)
Frequently asked(5)
What is CVE-2026-94047?
CVE-2026-94047 is a medium vulnerability published on September 20, 2026. A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32. The impacted element is the function importTemplate of the file src/services/templateService.ts of the component Template Import Endpoint. The manipulation leads to improper privilege management. Remote exploitation of…
When was CVE-2026-94047 disclosed?
CVE-2026-94047 was first published in the National Vulnerability Database on September 20, 2026, with the most recent update on September 21, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-94047 actively exploited?
CVE-2026-94047 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0% probability of exploitation in the next 30 days, which ranks it in the top 65.2% of all scored CVEs.
What is the CVSS score of CVE-2026-94047?
CVE-2026-94047 has a CVSS v3 base score of 6.3 (NVD).
How do I remediate CVE-2026-94047?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-94047, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.
Dependency Blast Radius
Explore the affected products and dependency analysis for CVE-2026-94047
Is Your Infrastructure Affected by CVE-2026-94047?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.