hyper-mcp: Improper signature verification of WebAssembly plugins

Summary

hyper-mcp through 0.8.3 does not properly verify the signer identity and OIDC issuer of OCI WebAssembly plugins by default. An attacker who controls a plugin image reference can sign a malicious image with a free Sigstore keyless certificate, and hyper-mcp will load it. The malicious plugin then runs with the host, filesystem, and environment capabilities configured for it.

Affected

• hyper-mcp through 0.8.3 (CVE record: versions 0 to 0.8.3 affected by default)
• Affected configurations: OCI plugins loaded without explicit signer identity and issuer restrictions

Fixed in

Unknown. The vendor has not confirmed a fixed version in the sources reviewed. One unverified third-party page mentions 0.8.4 or later.

Workaround

• Configure hyper-mcp to require specific signer identities and trusted OIDC issuers for OCI plugins
• Do not set insecure_skip_signature: true or HYPER_MCP_INSECURE_SKIP_SIGNATURE=true
• Load plugins only from registries and namespaces you control, and pin plugin references to a digest
• Do not expose hyper-mcp in SSE or streamable-HTTP mode on untrusted networks

Exploitation

• CISA SSVC: exploitation status PoC, automatable: no, technical impact: partial
• No evidence of exploitation in the wild found
• A write-up exists that may contain exploit details; not verified

Our recommendation

• Inventory all hyper-mcp installations and versions, including Homebrew and container images
• Apply the required signer and issuer restrictions now, and verify that signature skipping is disabled
• Review the permissions granted to each plugin (host, filesystem, environment)
• Monitor the vendor release page and GitHub Security Advisories and update as soon as a fix is confirmed

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE-2026-108699 on VulDB vuldb.com
• hyper-mcp on GitHub github.com
• VulnCheck advisory www.vulncheck.com
• hyper-mcp config.rs at v0.8.3 github.com
• hackMD write-up CVE-2026-108698/108699 hackmd.io
• Strix CVE-2026-108699 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:57.