CVE-2023-34097
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
In versions prior to 2023.4.5, hoppscotch exposes the database password in logs when showing the database connection string. Attackers with access to system logs can gain full access to the database.
Risk Assessment
Access to the database password in logs poses a serious security risk, allowing attackers to elevate privileges and gain full access to data.
Recommendation
It is recommended to upgrade to version 2023.4.5 or later to mitigate this vulnerability. There are no known workarounds for this issue.
Other vulnerabilities in hoppscotch
See all- CVE-2026-69189High
In Hoppscotch, an open source API development ecosystem, prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history identifier without enforcing userUid ownership, allowing an authenticated workspace member to read private request history, session data, request contents, authorization headers, environment values, and settings and to modify or delete the victim's private history entries.
- CVE-2026-44478High
CVE-2026-44478 vulnerability in hoppscotch allows unauthenticated users to access infrastructure secrets in plaintext via the GET /v1/onboarding/config endpoint when the ONBOARDING_RECOVERY_TOKEN is an empty string. This issue is fixed in version 2026.4.0.
- CVE-2026-50160Critical
In self-hosted Hoppscotch deployments version 2026.4.1 and earlier, the unauthenticated POST /v1/onboarding/config endpoint is vulnerable to mass assignment. The missing whitelist: true in NestJS ValidationPipe allows extra request properties like JWT_SECRET and SESSION_SECRET to be treated as valid InfraConfig entries, enabling an attacker to overwrite them.
- CVE-2026-34932Critical
Hoppscotch prior to version 2026.3.0 has a stored XSS vulnerability that can lead to CSRF.
- CVE-2026-34931Critical
Hoppscotch prior to version 2026.3.0 has an open redirect vulnerability that leads to token exfiltration. With these tokens, the attacker can sign in as the victim to takeover their account.
- CVE-2026-59721High
A vulnerability in Hoppscotch before version 2026.6.0 allows an admin to execute arbitrary commands as root in the backend container. The attack involves manipulating the MAILER_SMTP_URL parameter in the updateInfraConfigs GraphQL mutation, which is then parsed by nodemailer into sendmail transport options.
- CVE-2026-59720High
In Hoppscotch prior to version 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field, while schema.prisma defaults isPublic to true. This causes mock servers linked to private collections to be publicly accessible without authentication, potentially exposing sensitive API data.
- CVE-2026-34848Medium
Hoppscotch, an open source API development ecosystem, contains a stored XSS vulnerability in the team member overflow tooltip via display name. This issue exists prior to version 2026.3.0.
- CVE-2026-34847Medium
In hoppscotch before version 2026.3.0, the /enter page contains a DOM-based open redirect vulnerability. The redirect query parameter is directly used to construct a URL and redirect the user without proper validation.
Original NVD description (English source)
hoppscotch is an open source API development ecosystem. In versions prior to 2023.4.5 the database password is exposed in the logs when showing the database connection string. Attackers with access to read system logs will be able to elevate privilege with full access to the database. Users are advised to upgrade. There are no known workarounds for this vulnerability.