CVE-2026-108699

Impact

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign_verify_args() accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image with a free Sigstore keyless certificate to execute plugins with configured host, filesystem, and environment capabilities.

Affected products

Versions were read from the advisory text. No structured product data has been published for this record yet.

Weakness classification

References

• NVD record
• CVE.org record
• https://github.com/hyper-mcp-rs/hyper-mcp
• https://github.com/hyper-mcp-rs/hyper-mcp/blob/v0.8.3/src/config.rs#L138-L170
• https://github.com/hyper-mcp-rs/hyper-mcp/blob/v0.8.3/src/wasm/oci.rs#L157-L190
• https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/hyper-mcp-oci-signature-manifest-toctou
• https://www.vulncheck.com/advisories/hyper-mcp-through-0.8.3-improper-signature-verification-of-oci-webassembly-plugins
• https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/cve-2026-108698-108699-hyper-mcp-oci-signature-manifest-toctou