CVE-2026-108699: Improper Verification of Cryptographic Signature in hyper-mcp-rs hyper-mcp

The vulnerability in hyper-mcp (up to 0.8.3) arises from improper verification of cryptographic signatures in the cosign_verify_args() function. This function does not restrict signer identities or OIDC issuers, allowing attackers who control a plugin image reference to sign malicious WebAssembly plugins using free Sigstore keyless certificates. Consequently, these malicious plugins can be executed with the privileges configured for plugins, including access to host resources, filesystem, and environment variables.

An attacker can execute arbitrary malicious WebAssembly plugins within the hyper-mcp environment by exploiting the signature verification flaw. This can lead to unauthorized code execution with configured host, filesystem, and environment capabilities, potentially compromising the affected system's integrity and confidentiality. The CVSS 4.0 score of 8.3 reflects a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using untrusted plugin images and restrict plugin image references to trusted sources. Monitoring for updates from the hyper-mcp-rs project is recommended to apply any forthcoming patches promptly.