CVE-2026-34200

Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network port, applies no inbound authentication and does not enforce strict CORS. This allows a malicious website visited on the same machine to issue cross-origin requests to the MCP server and invoke privileged tools using the developer's locally configured credentials. This vulnerability requires two explicit, non-default configuration steps to be exploitable. The default nhost mcp start configuration is not affected. This issue has been patched in version 1.41.0.

• CWE-306
• CWE-942
• CWE-306

• https://github.com/nhost/nhost/commit/15eae9285f9dce63e184b9bb24616474ffa5ccc9Patch
• https://github.com/nhost/nhost/pull/4060Issue Tracking, Patch
• https://github.com/nhost/nhost/security/advisories/GHSA-6c5x-3h35-vvw2Exploit, Vendor Advisory
• https://github.com/nhost/nhost/security/advisories/GHSA-6c5x-3h35-vvw2Exploit, Vendor Advisory

Published

Mar 31, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34193Kernel software installed and running inside a Guest/Host VM…4.3
• CVE-2026-34194Software installed and run as a non-privileged user may cond…7.1
• CVE-2026-34195Software installed and run as a non-privileged user may cond…8.8
• CVE-2026-34196Software installed and run as a non-privileged user may cond…7.8
• CVE-2026-34197Improper Input Validation, Improper Control of Generation of…8.8
• CVE-2026-34198Coolify is an open-source and self-hostable tool for managin…5.3
• CVE-2026-34202ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…7.5
• CVE-2026-34203Nautobot is a Network Source of Truth and Network Automation…4.3
• CVE-2026-34204MinIO is a high-performance object storage system. Prior to …7.1
• CVE-2026-34205Home Assistant is open source home automation software that …9.6
• CVE-2026-34206Captcha Protect is a Traefik middleware to add an anti-bot c…6.1
• CVE-2026-34207TypeBot is a chatbot builder tool. In versions prior to 3.16…7.6