CVE-2026-34200

Nhost CLI MCP Server: Missing Inbound Authentication on Explicitly Bound Network Port

State: Published
Severity: 7.7 High
Published: Mar 31, 2026
Updated: Mar 31, 2026
Reserved: Mar 26, 2026

Description

Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network port, applies no inbound authentication and does not enforce strict CORS. This allows a malicious website visited on the same machine to issue cross-origin requests to the MCP server and invoke privileged tools using the developer's locally configured credentials. This vulnerability requires two explicit, non-default configuration steps to be exploitable. The default nhost mcp start configuration is not affected. This issue has been patched in version 1.41.0.

Scores

CVSS	Score	Vector	Source
4.0	7.7 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-306 Missing Authentication for Critical Function
CWE-942 Permissive Cross-domain Policy with Untrusted Domains

Affected Products

Product	Versions
nhostnhost	< 1.41.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.