CVE-2026-34200
Published: 31 March 2026
Summary
CVE-2026-34200 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Nhost Cli. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Protocol-Specific Risks risk domain.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2026-34200 is a vulnerability in the Nhost CLI MCP server, part of Nhost, an open-source Firebase alternative with GraphQL support. In versions prior to 1.41.0, the MCP server, when explicitly configured to listen on a network port, implements no inbound authentication and fails to enforce strict CORS policies. This exposes the server to unauthorized cross-origin requests from web contexts on the same host machine.
The vulnerability can be exploited by an attacker who tricks a developer into visiting a malicious website while the MCP server is running with the vulnerable configuration. No attacker privileges are required (PR:N), but exploitation demands network access (AV:N), high attack complexity (AC:H), and user interaction (UI:R) via the malicious site. Successful exploitation allows the attacker to issue cross-origin requests to the MCP server, invoking privileged tools using the developer's locally configured credentials, potentially leading to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H, CVSS 3.1 score of 7.5). It requires two explicit, non-default configuration steps, and the default "nhost mcp start" setup is unaffected.
Mitigation is available in Nhost version 1.41.0, which patches the authentication and CORS issues. The Nhost security advisory (GHSA-6c5x-3h35-vvw2) and associated GitHub pull request (#4060) and commit (15eae9285f9dce63e184b9bb24616474ffa5ccc9) detail the fix. Practitioners should upgrade to 1.41.0 or later and avoid non-default network-binding configurations for the MCP server.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17452
Vulnerability details
Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network port, applies no inbound authentication and does not enforce strict CORS. This allows a…
more
malicious website visited on the same machine to issue cross-origin requests to the MCP server and invoke privileged tools using the developer's locally configured credentials. This vulnerability requires two explicit, non-default configuration steps to be exploitable. The default nhost mcp start configuration is not affected. This issue has been patched in version 1.41.0.
- CWE(s)
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- Protocol-Specific Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: mcp
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in network-listening MCP server lacking auth/CORS enables exploitation via cross-origin requests from a malicious website (T1190: Exploit Public-Facing Application); attack requires tricking user into visiting the site (T1204.001: Malicious Link) to invoke privileged tools with local credentials.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces secure baseline configuration settings that prevent the explicit non-default network port binding required to expose the MCP server to cross-origin attacks.
Requires enforcement of authentication and access authorizations for inbound requests to the MCP server, directly countering the lack of inbound authentication.
Monitors and controls communications at the MCP server's network interface, blocking or detecting unauthorized cross-origin requests from malicious websites.