CVE-2026-47671

Received Received - Intake

Information Disclosure in Nhost CLI

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden `nhost configserver` used by `nhost dev` exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment, any process that can reach the developer's localhost service, including a web page loaded from an arbitrary origin, can query the configserver for local Nhost configuration and secrets and can mutate the local `.secrets` file. This impacts developers using `nhost dev`: project admin secrets, JWT signing keys, webhook secrets, Grafana credentials, and custom environment variables can be read, and attacker-controlled secrets can be written to the local development project. Version 1.46.0 of Nhost CLI contains a fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-47671

Affected Vendors & Products

Vendor	Product	Version / Range
nhost	nhost_cli	to 1.46.0 (exc)
nhost	nhost_cli	1.46.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability affects Nhost CLI versions prior to 1.46.0. The hidden configserver used by nhost dev exposes a GraphQL API with weak authorization and overly permissive CORS settings. This allows any process accessing localhost, including malicious web pages, to read or modify local project secrets like JWT keys, webhook secrets, and environment variables.

Detection Guidance

Check if you are running Nhost CLI versions prior to 1.46.0 by running 'nhost version'. If the version is below 1.46.0, the vulnerability may be present. Inspect network traffic on localhost for unexpected GraphQL queries to the configserver endpoint during 'nhost dev' sessions.

Impact Analysis

Attackers can read sensitive data such as project admin secrets, JWT signing keys, webhook secrets, Grafana credentials, and custom environment variables. They can also inject attacker-controlled secrets into the local .secrets file, potentially compromising the local development environment.

Compliance Impact

The vulnerability could lead to unauthorized access to sensitive data like JWT signing keys, webhook secrets, and environment variables during local development. This may violate GDPR's data protection principles if personal data is exposed, and HIPAA's safeguards if protected health information is compromised. The risk is limited to local environments but could still result in non-compliance if sensitive data is mishandled.

Mitigation Strategies

Upgrade Nhost CLI to version 1.46.0 or later immediately. Stop using 'nhost dev' in untrusted environments. Review local .secrets files for unauthorized changes and revoke any exposed secrets.

Hi! I’m here to help you understand CVE-2026-47671. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70