PT-2026-29264 · Nhost · Nhost

Published 2026-03-31 · Updated 2026-03-31 · CVE-2026-34200

Mitre

CVSS v4.0

7.7

High

AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network port, applies no inbound authentication and does not enforce strict CORS. This allows a malicious website visited on the same machine to issue cross-origin requests to the MCP server and invoke privileged tools using the developer's locally configured credentials. This vulnerability requires two explicit, non-default configuration steps to be exploitable. The default nhost mcp start configuration is not affected. This issue has been patched in version 1.41.0.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

CWE-942

Related Identifiers

CVE-2026-34200

Affected Products

Nhost

References · 4

• 🔥 https://github.com/nhost/nhost/security/advisories/GHSA-6c5x-3h35-vvw2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-34200 · Security Note
• https://github.com/nhost/nhost/commit/15eae9285f9dce63e184b9bb24616474ffa5ccc9 · Note
• https://github.com/nhost/nhost/pull/4060 · Note