CVE-2026-108699
hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign_verify_args() accepts any signer identity and OIDC issuer by default.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign_verify_args() accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image with a free Sigstore keyless certificate to execute plugins with configured host, filesystem, and environment capabilities.
- CVSS 4.0
- 8.3 HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.17% probability · 6th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-347
- Source
- disclosure@vulncheck.com
EPSS moved from 0.1% on 12 October 2026 to 0.2% on 27 October 2026.
References
- https://github.com/hyper-mcp-rs/hyper-mcp
- https://github.com/hyper-mcp-rs/hyper-mcp/blob/v0.8.3/src/config.rs#L138-L170
- https://github.com/hyper-mcp-rs/hyper-mcp/blob/v0.8.3/src/wasm/oci.rs#L157-L190
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/hyper-mcp-oci-signature-manifest-toctou
- https://www.vulncheck.com/advisories/hyper-mcp-through-0.8.3-improper-signature-verification-of-oci-webassembly-plugins
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/cve-2026-108698-108699-hyper-mcp-oci-signature-manifest-toctou
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.