CVE-2026-34200

HIGH EPSS 28.0%
Published Mar 31, 20263mo ago · Modified Jun 17, 20262w ago
7.7 CVSS 4.0
High
Find Similar
Published Mar 31, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network port, applies no inbound authentication and does not enforce strict CORS. This allows a malicious website visited on the same machine to issue cross-origin requests to the MCP server and invoke privileged tools using the developer's locally configured credentials. This vulnerability requires two explicit, non-default configuration steps to be exploitable. The default nhost mcp start configuration is not affected. This issue has been patched in version 1.41.0.

CVSS Details

Base Score
7.7
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction P
Scope X

Threat Intelligence

EPSS Exploit Probability
28.0% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-306 Missing Authentication for Critical Function Authentication
CWE-942

Affected Products 1

VendorProductVersionRange
nhostcli* <1.41.0

References 3

  • github.com https://github.com/nhost/nhost/commit/15eae9285f9dce63e184b9bb24616474ffa5ccc9
    Patch
  • github.com https://github.com/nhost/nhost/pull/4060
    Issue TrackingPatch
  • github.com https://github.com/nhost/nhost/security/advisories/GHSA-6c5x-3h35-vvw2
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/nhost/nhost/commit/15eae9285f9dce63e184b9bb24616474ffa5ccc9
    Patch
  • github.com https://github.com/nhost/nhost/pull/4060
    Issue TrackingPatch