hyper-mcp Cosign 校验可绕过，涉及两处 CVE
Start here
安全研究者 hieuPenguinnn 披露，Rust 编写的 MCP 服务器 hyper-mcp 在从 OCI registry 加载 WebAssembly 插件时存在 TOCTOU 竞态，Cosign 签名校验可被绕过。load_wasm 把解析出的 manifest 摘要只用作缓存键，却将可变 tag 交给 cosign verify，并仅凭进程退出码判定成功，从不比对 Cosign 实际校验的摘要；默认身份策略还把 ident 设为通配，进一步放宽校验。该问题涉及两个 CVE。
Generated by AI from reports · Updated 10 hr ago
Progress timeline
- HackMDhyper-mcp's Cosign verification can be bypassed, involving two CVEs
Security researcher hieuPenguinnn disclosed that hyper-mcp, an MCP server written in Rust, has a TOCTOU race condition when loading WebAssembly plugins from an OCI registry, allowing Cosign signature verification to be bypassed. load_wasm uses the parsed manifest digest only as a cache key, but passes the mutable tag to cosign verify, and determines success solely by the process exit code, never comparing the digest actually verified by Cosign. The default identity policy also sets both the identity and issuer regexes to .*, so any valid keyless signature passes. A malicious or compromised registry, tag takeover, or TLS man-in-the-middle can cause pull_manifest to return manifest A while Cosign returns a signed manifest B, thereby loading attacker-specified WASM from A, running under the host, path, environment, and memory permissions configured for that plugin.
Related discussion
Attention trend
New sources per day
- Oct 12New1 sources (1 outlets,0 accounts)
- Oct 13New0 sources (0 outlets,0 accounts)