Executive brief
Nhost is an open-source development platform used as an alternative to Firebase. In affected versions of its command-line interface (CLI), a background service used during local development fails to properly restrict access. This allows malicious websites visited by a developer to steal sensitive project secrets—such as admin keys and JWT signing keys—or modify local configuration files, potentially leading to a full compromise of the development environment.
Technical details
A vulnerability in the hidden `nhost configserver` component, triggered by the `nhost dev` command, stems from missing authentication (CWE-306) and overly permissive CORS policies. The Mimir GraphQL API is exposed with dummy authorization directives, allowing any process capable of reaching the developer's localhost—including a browser executing code from an arbitrary origin—to query or mutate local configuration. Attackers can exploit this via Cross-Origin Resource Sharing (CORS) to read sensitive data like project admin secrets, JWT signing keys, and webhook secrets, or to overwrite the local `.secrets` file. The fix in version 1.46.0 introduces regex-validated origin checks, redacts secrets in memory, and implements a per-project random UUIDv4 for authentication.
Affected products
- Nhost CLI < 1.46.0
Timeline
- 2026-05-18: patched: Fix committed to main branch
- 2026-05-19: advisory: Release cli@1.46.0 published
- 2026-07-21: disclosed: CVE-2026-47671 published