CVE-2026-108698 Details

A vulnerability exists in hyper-mcp versions through 0.8.3, allowing for a signature verification bypass in the WebAssembly plugin loading process. The issue arises because the Cosign signature is verified against a separately resolved tag, rather than the manifest actually being loaded. This flaw enables attackers controlling registry responses to serve an unsigned malicious manifest to the loader while providing a signed one to Cosign, potentially executing unauthorized WebAssembly plugins with specified host capabilities.

The vulnerability can be addressed by modifying the hyper-mcp OCI plugin loader to verify the resolved digest against the Cosign-verified digest before loading any WebAssembly layers. This ensures that only properly signed and verified plugins are executed. Additionally, updating the default behavior to reject mutable tags for OCI plugins can further reduce the risk of similar vulnerabilities in the future.