Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network port, applies no inbound authentication and does not enforce strict CORS. This allows a malicious website visited on the same machine to issue cross-origin requests to the MCP server and invoke privileged tools using the developer's locally configured credentials. This vulnerability requires two explicit, non-default configuration steps to be exploitable. The default nhost mcp start configuration is not affected. This issue has been patched in version 1.41.0.
References
| Link | Resource |
|---|---|
| https://github.com/nhost/nhost/commit/15eae9285f9dce63e184b9bb24616474ffa5ccc9 | Patch |
| https://github.com/nhost/nhost/pull/4060 | Issue Tracking Patch |
| https://github.com/nhost/nhost/security/advisories/GHSA-6c5x-3h35-vvw2 | Exploit Vendor Advisory |
| https://github.com/nhost/nhost/security/advisories/GHSA-6c5x-3h35-vvw2 | Exploit Vendor Advisory |
Configurations
History
07 Apr 2026, 21:08
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CPE | cpe:2.3:a:nhost:cli:*:*:*:*:*:*:*:* | |
| First Time |
Nhost cli
Nhost |
|
| References | () https://github.com/nhost/nhost/commit/15eae9285f9dce63e184b9bb24616474ffa5ccc9 - Patch | |
| References | () https://github.com/nhost/nhost/pull/4060 - Issue Tracking, Patch | |
| References | () https://github.com/nhost/nhost/security/advisories/GHSA-6c5x-3h35-vvw2 - Exploit, Vendor Advisory |
31 Mar 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-31 15:16
Updated : 2026-04-07 21:08
NVD link : CVE-2026-34200
Mitre link : CVE-2026-34200
CVE.ORG link : CVE-2026-34200
JSON object : View
Products Affected
nhost
- cli