CVE-2026-34200

HighPublic PoC

Published: 31 March 2026

Published

31 March 2026

Modified

07 April 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0010 26.6th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-34200 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Nhost Cli. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Protocol-Specific Risks risk domain.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and CM-6 (Configuration Settings).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

CM-6 Configuration Settings good match

prevent

Enforces secure baseline configuration settings that prevent the explicit non-default network port binding required to expose the MCP server to cross-origin attacks.

AC-3 Access Enforcement good match

prevent

Requires enforcement of authentication and access authorizations for inbound requests to the MCP server, directly countering the lack of inbound authentication.

SC-7 Boundary Protection good match

preventdetect

Monitors and controls communications at the MCP server's network interface, blocking or detecting unauthorized cross-origin requests from malicious websites.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1204.001 Malicious Link Execution

An adversary may rely upon a user clicking a malicious link in order to gain execution.

attack.mitre.org →

Why these techniques?

Vulnerability in network-listening MCP server lacking auth/CORS enables exploitation via cross-origin requests from a malicious website (T1190: Exploit Public-Facing Application); attack requires tricking user into visiting the site (T1204.001: Malicious Link) to invoke privileged tools with local credentials.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network port, applies no inbound authentication and does not enforce strict CORS. This allows a…

malicious website visited on the same machine to issue cross-origin requests to the MCP server and invoke privileged tools using the developer's locally configured credentials. This vulnerability requires two explicit, non-default configuration steps to be exploitable. The default nhost mcp start configuration is not affected. This issue has been patched in version 1.41.0.

Deeper analysisAI

CVE-2026-34200 is a vulnerability in the Nhost CLI MCP server, part of Nhost, an open-source Firebase alternative with GraphQL support. In versions prior to 1.41.0, the MCP server, when explicitly configured to listen on a network port, implements no inbound authentication and fails to enforce strict CORS policies. This exposes the server to unauthorized cross-origin requests from web contexts on the same host machine.

The vulnerability can be exploited by an attacker who tricks a developer into visiting a malicious website while the MCP server is running with the vulnerable configuration. No attacker privileges are required (PR:N), but exploitation demands network access (AV:N), high attack complexity (AC:H), and user interaction (UI:R) via the malicious site. Successful exploitation allows the attacker to issue cross-origin requests to the MCP server, invoking privileged tools using the developer's locally configured credentials, potentially leading to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H, CVSS 3.1 score of 7.5). It requires two explicit, non-default configuration steps, and the default "nhost mcp start" setup is unaffected.

Mitigation is available in Nhost version 1.41.0, which patches the authentication and CORS issues. The Nhost security advisory (GHSA-6c5x-3h35-vvw2) and associated GitHub pull request (#4060) and commit (15eae9285f9dce63e184b9bb24616474ffa5ccc9) detail the fix. Practitioners should upgrade to 1.41.0 or later and avoid non-default network-binding configurations for the MCP server.