Description
hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign_verify_args() accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image with a free Sigstore keyless certificate to execute plugins with configured host, filesystem, and environment capabilities.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
hyper-mcp-rs hyper-mcp
Default version status: unaffected
0 to ≤ 0.8.3affected
pkg:cargo/hyper-mcpReferences
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/hyper-mcp-oci-signature-manifest-toctou ↗
- https://github.com/hyper-mcp-rs/hyper-mcp/blob/v0.8.3/src/wasm/oci.rs#L157-L190 ↗
- https://github.com/hyper-mcp-rs/hyper-mcp/blob/v0.8.3/src/config.rs#L138-L170 ↗
- https://github.com/hyper-mcp-rs/hyper-mcp ↗
- https://www.vulncheck.com/advisories/hyper-mcp-through-0.8.3-improper-signature-verification-of-oci-webassembly-plugins ↗
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/cve-2026-108698-108699-hyper-mcp-oci-signature-manifest-toctou ↗