CVE-2026-34200

Katalog CVE

CVSS 7.5 · High EPSS 0,60%

Kerentanan Missing Authentication for Critical Function pada nhost cli. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network port, applies no inbound authentication and does not enforce strict CORS. This allows a malicious website visited on the same machine to issue cross-origin requests to the MCP server and invoke privileged tools using the developer's locally configured credentials. This vulnerability requires two explicit, non-default configuration steps to be exploitable. The default nhost mcp start configuration is not affected. This issue has been patched in version 1.41.0.

Rincian

Terbit di NVD

31 Maret 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function
CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains

EPSS (30 hari)

0,60% peluang dieksploitasi; lebih tinggi dari 47,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nhost/nhost/security/advisories/GHSA-6c5x-3h35-vvw2 exploit · advisory vendor
• https://github.com/nhost/nhost/commit/15eae9285f9dce63e184b9bb24616474ffa5ccc9 patch
• https://github.com/nhost/nhost/pull/4060 issue tracking · patch