CVE-2026-34200 - Vulnerability Analysis

Overview

Nhost CLI MCP server < 1.41.0 contains a cross-site request forgery caused by lack of inbound authentication and missing strict CORS enforcement, letting malicious websites on the same machine invoke privileged tools using local credentials, exploit requires explicit non-default configuration.

Severity & Score

Impact

Malicious websites on the same machine can invoke privileged tools using developer's credentials, potentially leading to unauthorized actions.

Mitigation

Update to version 1.41.0 or later.

References

• https://github.com/nhost/nhost/security/advisories/GHSA-6c5x-3h35-vvw2
• https://github.com/nhost/nhost/commit/15eae9285f9dce63e184b9bb24616474ffa5ccc9
• https://github.com/nhost/nhost/pull/4060

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner