hyper-mcp: Signature verification bypass via TOCTOU race condition in OCI plugin loading

Summary

hyper-mcp through version 0.8.3 verifies the Cosign signature of a separately resolved tag instead of the manifest that is actually loaded. An attacker who controls registry responses for a plugin tag can serve an unsigned, malicious manifest to the loader while a signed one is shown to Cosign. This can execute unsigned WebAssembly plugins with the host capabilities configured for them, such as network access.

Affected

• hyper-mcp versions 0.8.3 and earlier (VulnCheck: affected 0 to <= 0.8.3)

Fixed in

• Unknown. No vendor-confirmed fixed version was found. Check the upstream releases page and security advisories before relying on any version number.

Workaround

• Do not disable signature verification; confirm that insecure_skip_signature is not set in the configuration and HYPER_MCP_INSECURE_SKIP_SIGNATURE is not set on any host.
• Load plugins only from registries and namespaces you control (inferred from the preconditions, not a vendor recommendation).
• Pin plugins by immutable digest instead of mutable tags, after testing whether hyper-mcp enforces digest-based loading.
• Restrict write access to the plugin registry and limit the hosts the server can reach.

Exploitation

• No confirmed exploitation in the wild; not listed in CISA KEV.
• CISA SSVC: exploitation none, automatable no, technical impact partial.
• Public proof of concept status is unclear.

Our recommendation

• Check whether hyper-mcp is deployed and which version is running; treat 0.8.3 and earlier as affected.
• Verify that signature verification is enabled on all hosts.
• Restrict plugin sources to trusted registries and pin plugins by digest where possible.
• Limit network exposure of the server, especially for SSE or HTTP transports, and monitor plugin loading.
• Review CVE-2026-108699 separately, as patching this issue does not address it.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• OSV record CVE-2026-108698 osv.dev
• hyper-mcp upstream repository github.com
• hyper-mcp oci.rs at v0.8.3 (load_wasm) github.com
• hyper-mcp v0.8.3 release github.com
• PSIRT CVE-2026-108698 psirt.com
• Strix CVE-2026-108698 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:56.