Log in Start free

Vulnerability · Published Jul 21, 2026 · Assigned by GitHub_M

CVE-2026-47671Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets

Medium 5.4

In plain English

A medium-severity missing authentication in cli from nhost. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.4%top 70.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden `nhost configserver` used by `nhost dev` exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment, any process that can reach the developer's localhost service, including a web page loaded from an arbitrary origin, can query the configserver for local Nhost configuration and secrets and can mutate the local `.secrets` file. This impacts developers using `nhost dev`: project admin secrets, JWT signing keys, webhook secrets, Grafana credentials, and custom environment variables can be read, and attacker-controlled secrets can be written to the local development project. Version 1.46.0 of Nhost CLI contains a fix.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/nhost/nhost0.0.0-20260518172022-e407511627d2GHSA-64cj-qvx5-m4f3
Gogithub.com/nhost/nhost0.0.0-20260518172022-e407511627d2GO-2026-5166

Affected products (as reported)

VendorProductVersions
nhost cli < 1.46.0

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References