CVE-2026-34200

HighCVSS 7.5

Published: 31/03/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

29th percentile - higher than 29% of all known CVEs

Summary

Nhost prior to version 1.41.0 contains a vulnerability in the MCP CLI server when configured to listen on a network port. It applies no inbound authentication and does not enforce strict CORS. A malicious website visited on the same machine can send cross-origin requests to the MCP server and invoke privileged tools using the developer's locally configured credentials.

Risk Assessment

An attacker could execute arbitrary commands on the MCP server using the developer's credentials, potentially leading to application compromise.

Recommendation

Update Nhost to version 1.41.0 or later. The default configuration is not vulnerable.

Other vulnerabilities in Nhost

CVE-2026-41574Critical
Nhost, an alternative to Firebase, prior to version 0.49.1 automatically linked an incoming OAuth identity to an existing Nhost account when email addresses matched. The issue was that some provider adapters incorrectly populated the email verification field, potentially leading to unauthorized access.

Original NVD description (English source)

Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network port, applies no inbound authentication and does not enforce strict CORS. This allows a malicious website visited on the same machine to issue cross-origin requests to the MCP server and invoke privileged tools using the developer's locally configured credentials. This vulnerability requires two explicit, non-default configuration steps to be exploitable. The default nhost mcp start configuration is not affected. This issue has been patched in version 1.41.0.