mcp-hub

The server allows configuration of `stdio` transport type for MCP servers, which executes arbitrary commands and arguments directly on the host machine. If an authenticated user (even an owner, not just admin) can configure `command` and `args` in the `MCPServer` model, it creates a severe remote code execution vulnerability. There is no explicit input sanitization or whitelisting for these fields. Additionally, the system makes dynamic external requests to `server.url` during OAuth discovery, token exchange, and FastMCP client operations, which could potentially expose the backend to SSRF or other network-based attacks if `server.url` is controlled by a malicious actor and not adequately validated beyond basic URL parsing.