CVE-2026-34200

N/A

Description

Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network port, applies no inbound authentication and does not enforce strict CORS. This allows a malicious website visited on the same machine to issue cross-origin requests to the MCP server and invoke privileged tools using the developer's locally configured credentials. This vulnerability requires two explicit, non-default configuration steps to be exploitable. The default nhost mcp start configuration is not affected. This issue has been patched in version 1.41.0.

CVE Details

CVSS v3.1 ScoreN/A

Published3/31/2026

Last Modified4/1/2026

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-306CWE-942

References

https://github.com/nhost/nhost/commit/15eae9285f9dce63e184b9bb24616474ffa5ccc9(security-advisories@github.com)

https://github.com/nhost/nhost/pull/4060(security-advisories@github.com)

https://github.com/nhost/nhost/security/advisories/GHSA-6c5x-3h35-vvw2(security-advisories@github.com)

https://github.com/nhost/nhost/security/advisories/GHSA-6c5x-3h35-vvw2(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.