9 matches found
CVE-2026-108699
hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosignverifyargs accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image...
CVE-2026-108699
hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosignverifyargs accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image...
CVE-2026-108699 hyper-mcp through 0.8.3 Improper Signature Verification of OCI WebAssembly Plugins
hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosignverifyargs accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image...
CVE-2026-108699 hyper-mcp through 0.8.3 Improper Signature Verification of OCI WebAssembly Plugins
hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosignverifyargs accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image...
EUVD-2026-96999
hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosignverifyargs accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image...
CVE-2026-108699
The hyper-mcp framework (versions through 0.8.3 ) is vulnerable to an improper signature verification flaw involving OCI WebAssembly plugins. The root cause is that the cosign_verify_args() function accepts any signer identity and OIDC issuer by default. This allows an attacker who controls a plu...
CVE-2026-108699 hyper-mcp through 0.8.3 Improper Signature Verification of OCI WebAssembly Plugins
hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosignverifyargs accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image...
CVE-2026-108699: Improper Verification of Cryptographic Signature
hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosignverifyargs accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image...
Hyper-MCP encryption issue vulnerabilities
Hyper-MCP versions 0.8.3 and earlier have an encryption-related vulnerability. This vulnerability stems from the fact that cosignverifyargs accepts any signer identity and OIDC issuer by default. Improper signature verification may allow attackers to load malicious WebAssembly plugins, which can...