---
id: CVE-2026-34200
title: Nhost is an open source Firebase alternative with GraphQL
summary: >-
  Nhost is an open source Firebase alternative with GraphQL. Prior to version
  1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a
  network port, applies no inbound authentication and does not enforce strict
  CORS. Thi…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-306
  - CWE-942
  - CWE-306
vendor: nhost
product: cli
affected:
  - cli < 1.41.0
patched:
  - cli 1.41.0
published: '2026-03-31'
updated: '2026-07-24'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-34200'
references:
  - url: >-
      https://github.com/nhost/nhost/commit/15eae9285f9dce63e184b9bb24616474ffa5ccc9
    label: security-advisories@github.com
  - url: 'https://github.com/nhost/nhost/pull/4060'
    label: security-advisories@github.com
  - url: 'https://github.com/nhost/nhost/security/advisories/GHSA-6c5x-3h35-vvw2'
    label: security-advisories@github.com
  - url: 'https://github.com/nhost/nhost/security/advisories/GHSA-6c5x-3h35-vvw2'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - exploit-available
epss: 0.00361
epssPercentile: 0.29885
ingestedAt: '2026-07-24T21:39:13.351Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/skoveit/CVE-2026-34200'
  checkedAt: '2026-09-24T07:53:02.572Z'
exploitAvailable: true
---

## Overview

Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network port, applies no inbound authentication and does not enforce strict CORS. This allows a malicious website visited on the same machine to issue cross-origin requests to the MCP server and invoke privileged tools using the developer's locally configured credentials. This vulnerability requires two explicit, non-default configuration steps to be exploitable. The default nhost mcp start configuration is not affected. This issue has been patched in version 1.41.0.

## Affected

- `cli < 1.41.0`

## Remediation

Upgrade past the affected range:

- `cli 1.41.0`