Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-94047

samanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges management

Medium5.3Public exploitEPSS 0.43%
Published
Updated
Reserved
Assigned by
VulDB

Description

A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32. The impacted element is the function importTemplate of the file src/services/templateService.ts of the component Template Import Endpoint. The manipulation leads to improper privilege management. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Upgrading to version 1.0.33 is sufficient to resolve this issue. The identifier of the patch is 18a4467bc4ec6390b1f841d8a468a37e9922f837. It is advisable to upgrade the affected component.

Public exploit

A reference of the record is tagged as an exploit or proof of concept: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.

Timeline

  1. ID reserved

    By VulDB

  2. · 1 day later

    Published

  3. · 2 days later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-94047, by who scored it
Scored byCVSSScoreVector
VulDBCNA (assigner)4.0Medium5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
VulDBCNA (assigner)3.1Medium6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
VulDBCNA (assigner)3.0Medium6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
VulDBCNA (assigner)2.0Medium6.5AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
NVDNVD · Deferred4.0Low2.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.43% · top 63% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: poc · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

Affected products

  • samanhappy · MCPHub

    • affected 1.0.0
    • affected 1.0.1
    • affected 1.0.2
    • affected 1.0.3
    • affected 1.0.4
    • affected 1.0.5
    • affected 1.0.6
    • affected 1.0.7
    • affected 1.0.8
    • affected 1.0.9
    • affected 1.0.10
    • affected 1.0.11
    • affected 1.0.12
    • affected 1.0.13
    • affected 1.0.14
    • affected 1.0.15
    • affected 1.0.16
    • affected 1.0.17
    • affected 1.0.18
    • affected 1.0.19
    • affected 1.0.20
    • affected 1.0.21
    • affected 1.0.22
    • affected 1.0.23
    • affected 1.0.24
    • affected 1.0.25
    • affected 1.0.26
    • affected 1.0.27
    • affected 1.0.28
    • affected 1.0.29
    • affected 1.0.30
    • affected 1.0.31
    • affected 1.0.32
    • unaffected 1.0.33

References (9)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-94047 badge
[![CVE-2026-94047](https://trackcve.app/badge/CVE-2026-94047.svg)](https://trackcve.app/cve/CVE-2026-94047)

Record last updated .