CVE-2026-44450

Vulnerability

In Lumiverse versions prior to 0.9.7, the MCP server creation endpoint (POST /api/v1/mcp-servers) validates the command field against an allowlist of binary names (e.g., node, bun, python3, deno) but forwards the args array to the child process without any validation [1]. Every binary on the allowlist accepts an inline-code execution flag (-e for node/bun, -c for python3/deno), which means an attacker can pass arbitrary code as an argument. The route only requires the requireAuth middleware (not requireOwner), so any logged-in user can trigger this behavior. Additionally, the server binds on all interfaces (::) and the host-header rebinding check can be bypassed by any HTTP client that sends Host: localhost: directly, making the endpoint reachable from any machine with network access to the server port [1].

Exploitation

An attacker must have a valid session cookie for any authenticated Lumiverse user. The attacker then sends a POST request to /api/v1/mcp-servers with a JSON body that specifies a transport_type of "stdio", a command from the allowlist (e.g., "node"), and args containing the code-execution flag and the attacker's payload (e.g., ["-e", "require('fs').writeFileSync('/tmp/rce_proof.txt','pwned')"]). Following that, a POST to /api/v1/mcp-servers//connect triggers the creation of the child process, executing the arbitrary OS-level command [1]. No special network position is required beyond TCP connectivity to the Lumiverse server port; the host-header bypass makes this directly exploitable from any client.

Impact

Successful exploitation grants the attacker arbitrary OS-level code execution as the Lumiverse server process user. This completely compromises the confidentiality, integrity, and availability of the server and the data it processes. An authenticated user can exfiltrate database contents, modify application files, install backdoors, or pivot to other internal systems. When chained with two other vulnerabilities (not detailed in the available references), an attacker could achieve unauthenticated RCE [1].

Mitigation

The vulnerability is fixed in Lumiverse version 0.9.7 [1]. Users should upgrade all lumiverse-backend installations to version 0.9.7 or later immediately. No workarounds are documented in the available references. Servers running versions 0.9.5 and earlier are affected; there is no indication that the package has reached end-of-life. This vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of this writing.