Skip to content
OpenAdvisories

Product · hyper-mcp-rs

hyper-mcp

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-108699

    hyper-mcp through 0.8.3 Improper Signature Verification of OCI WebAssembly Plugins

    hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign_verify_args() accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin i…

    hyper-mcp-rs hyper-mcp
  • Medium 6.5
    CVE-2026-108698

    hyper-mcp through 0.8.3 OCI Plugin Signature Verification TOCTOU Race Condition

    hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/oci.rs that verifies the Cosign signature of a separately resolved tag rather than the loaded manifest. Attackers controlling registry responses for the ta…

    hyper-mcp-rs hyper-mcp