The posture, written down — including what it does not cover.
Hangar enforces deterministic policy on the MCP call path and records what happened. That draws a boundary, and a security page is only worth reading if it draws it honestly. These pages track the CVEs that matter to anyone running MCP servers, and map Hangar against the OWASP MCP Top 10 — marking the categories that are out of scope by design rather than claiming them.
Posture pages
- MCP ecosystem CVE ledgerPublished CVEs in the MCP ecosystem that matter to anyone running MCP servers behind Hangar — what each one is, and whether Hangar's controls relate to it. Including when they do not.Updated Oct 4, 2026
- OWASP MCP Top 10 coverageWhere MCP Hangar maps against the OWASP MCP Top 10 (2025) — what it enforces, which component does it, and the three categories that are out of scope by design.Updated Oct 20, 2026
Advisories
On GitHubVulnerabilities in Hangar itself are disclosed as GitHub security advisories on mcp-hangar/mcp-hangar. This list is built from the published ones; each entry links to the full advisory, with affected versions and upgrade guidance.
- lowGHSA-624f-g334-j7x2A standalone gateway with durable storage never deregisters a discovered server, and keeps routing to its old addressFixed in 2.36.4
- highGHSA-cfcx-vrqr-qr84Tool digest pin does not cover title, annotations or _meta, so a rug-pull through those fields passes the pinFixed in 2.30.0
- highGHSA-qrgf-hc7g-w6v6Hot-loaded registry entries can request arbitrary host environment variables and secret filesFixed in 2.30.0
- lowGHSA-3vqv-89q2-8m26A silent stdio upstream that fails tools/list blocks the starting gateway thread indefinitelyFixed in 2.20.0
- mediumGHSA-4wc3-66v8-968jConcurrent appends drop a tool call's events, audit records included, report a successful call as failed, and fail auth-store role and key revocationsFixed in 2.20.0
- mediumGHSA-5gq2-5qfw-23p6SSRF policy bypassed by an IPv4-mapped IPv6 literal endpointAffects <= 2.5.1
- mediumGHSA-6fp8-g5qw-73g7A failed or repeated upstream start leaks the transport client and its child process or connectionFixed in 2.20.0
- highGHSA-9mfg-mfwg-7cvrTool calls skip group- and tenant-scoped governance: member-direct calls bypass group policy, approval lists are not enforced, and a withdrawal during an approval hold is not re-checkedFixed in 2.20.0
- highGHSA-j393-8j4v-v73rCapability enforcement in block and quarantine modes does not stop a drifting server, so undeclared upstream tools still runFixed in 2.20.0
- mediumGHSA-pfrp-gjcw-mxq3Truncated-result continuations are fetchable across tenants, and their ids are logged at INFOFixed in 2.20.0
- highGHSA-48jg-9vqq-gmqvTenant-scoped role grants apply fleet-wide: cross-tenant event and history reads, and cross-tenant or global tool withdrawalFixed in 2.19.0
- mediumGHSA-fhwh-fmq2-7m5cSession suspension is never enforced: a suspended session keeps invoking toolsFixed in 2.19.1
- mediumGHSA-qwq2-7g49-jxc6Tool error text exported in trace status; baggage scrubber trusts a caller-forgeable prefix and is skipped on stdioFixed in 2.19.1
Write-ups on the blog
Reporting a vulnerability
Found something in Hangar itself? The disclosure process — where to send it and what to expect — is in the docs. Please do not open a public issue for a security report.
Security policy & disclosure