CVE-2026-108698 hyper-mcp through 0.8.3 OCI Plugin Signature Verification TOCTOU Race Condition
Attackers can bypass signature verification via a race condition to execute malicious WebAssembly plugins with host capabilities in hyper-mcp.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-108698?
CVE-2026-108698 is a high-severity vulnerability in hyper-mcp-rs hyper-mcp, published on 11 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/oci.rs that verifies the Cosign signature of a separately resolved tag rather than the loaded manifest. Attackers controlling registry responses for the tag can serve an unsigned malicious manifest to the loader and a signed one to Cosign, executing unsigned WebAssembly plugins with configured host capabilities.
Weakness: CWE-367
Which versions are affected by CVE-2026-108698?
How do I fix CVE-2026-108698?
No fix has been published for CVE-2026-108698 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-108698 being exploited?
There is no known exploitation of CVE-2026-108698 in the wild and no public exploit code.
Sources
Also known as GHSA-phv4-c98f-77h3.