CVE-2026-108699

The hyper-mcp framework (versions through 0.8.3 ) is vulnerable to an improper signature verification flaw involving OCI WebAssembly plugins. The root cause is that the cosign_verify_args() function accepts any signer identity and OIDC issuer by default. This allows an attacker who controls a plu...

EUVD-2026-96999

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosignverifyargs accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image...