A plugin signature check is meaningful only when the cryptographic subject is the same content subsequently loaded. In Hyper-MCP, the reported race lets the loader resolve a mutable OCI tag, while Cosign independently resolves that tag for verification. An adversary controlling registry responses can exploit the gap between those two lookups. A successful…
Inspect the ClaimsCase · DiggingBeagle record
Hyper-MCP checks a different OCI tag resolution from the plugin it loads
Hyper-MCP through 0.8.3 could verify a separately resolved Cosign tag rather than the loaded OCI manifest, allowing mismatched signed and unsigned plugin bytes.
Scope
Reported finding as of 2026-10-13; publication and observation dates are distinguished in the linked source. No production exploitation is inferred without explicit evidence.
Assessment profile
Assessment method- Exploitation
- not established
- Evidence
- Grade C
- AI role
- AGAINST AI
Basis and provenance
Evidence desk assessment of the pinned Claims and source provenance, checked against the public primary report or advisory. The OSV/CVE record identifies separate manifest resolutions for the loaded image and signature verification. Its generated fixed/last-affected version metadata conflicts; a safe tagged release is not independently confirmed. Impact remains unbanded because verified real-world affected scope and realized harm are not established. Findings are not independent reproduction by DiggingBeagle.
Assessed Oct 14, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP5-HYPERMCP-TAG-TOCTOU-1 · CLM-CP5-HYPERMCP-TAG-TOCTOU-2 · OSV CVE-2026-108698: Hyper-MCP OCI verification time-of-check race
At a glance
A valid signature on manifest B cannot authorize execution of manifest A if the loader and verifier fetched different mutable tag resolutions. This is a race between a trust decision and the object consumed, independent of whether the expected signer is allowlisted. The advisory describes a capability-constrained plugin execution path, not a demonstrated…
Read the implicationsActual malicious plugin execution in a named deployment is not established. The reported range metadata does not independently establish fixed-version behavior.
Limits and uncertaintyFull account
A plugin signature check is meaningful only when the cryptographic subject is the same content subsequently loaded. In Hyper-MCP, the reported race lets the loader resolve a mutable OCI tag, while Cosign independently resolves that tag for verification. An adversary controlling registry responses can exploit the gap between those two lookups.
A successful manipulation could place an unsigned WebAssembly plugin into the runtime with the host capabilities already configured for that plugin. That is distinct from arbitrary host privileges, and distinct from the signer-identity default addressed in a separate CVE. The public record documents a vulnerability mechanism, not confirmed exploitation of deployed plugin registries.
Claims & evidence
CLM-CP5-HYPERMCP-TAG-TOCTOU-1CVE-2026-108698 describes load_wasm verifying a separate resolution of an OCI tag instead of the actual manifest previously retrieved for loading.supported
Basis: reported finding
- supportsOSV CVE-2026-108698: Hyper-MCP OCI verification time-of-check raceprimary disclosure
Details: load_wasm; Cosign separate tag resolution
CLM-CP5-HYPERMCP-TAG-TOCTOU-2A party controlling registry tag responses could give an unsigned plugin to the loader and a signed manifest to Cosign, so verified identity need not bind to the executed WebAssembly bytes.supported
Basis: reported finding
- supportsOSV CVE-2026-108698: Hyper-MCP OCI verification time-of-check raceprimary disclosure
Details: unsigned malicious manifest and signed tag returned to Cosign
Implications
A valid signature on manifest B cannot authorize execution of manifest A if the loader and verifier fetched different mutable tag resolutions. This is a race between a trust decision and the object consumed, independent of whether the expected signer is allowlisted. The advisory describes a capability-constrained plugin execution path, not a demonstrated compromise of a particular deployment.
Controls and mitigations
- Resolve an OCI reference once, verify the signature over that immutable manifest digest and load exactly that verified digest.
- Treat mutable tags and registry responses as untrusted; restrict plugin host capabilities and verify a known patched release rather than relying on contradictory converted version metadata.
Unknowns and contradictions
- Actual malicious plugin execution in a named deployment is not established.
- The reported range metadata does not independently establish fixed-version behavior.
Sources and citation
Material revision history
- Oct 13, 2026 · Published version · first publication · revision 144