Is CVE-2026-50160 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50160 being exploited in the wild.

How severe is CVE-2026-50160?

Critical severity, with a CVSS score of 10, published 1 July 2026.

Is there a fix for CVE-2026-50160?

A patch was published on 2026-04-21: Initial pull request for fix submitted Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50160 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-50160?

Check whether you run Hoppscotch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50160: Hoppscotch mass assignment in onboarding config endpoint

CVE-2026-50160 · Severity: critical · CVSS 10 · Published 2026-07-01

A critical vulnerability exists in Hoppscotch, a popular tool for API development, specifically affecting self-hosted deployments. An attacker can exploit a flaw in the initial setup process to overwrite the system's security keys without needing a password. This allows the attacker to forge administrative credentials, leading to a total takeover of the server and access to all user data.

Technologies: Hoppscotch. Vendors: Hoppscotch.

Quick answers

Is CVE-2026-50160 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50160 being exploited in the wild.
How severe is CVE-2026-50160?: Critical severity, with a CVSS score of 10, published 1 July 2026.
Which products and versions are affected?: Hoppscotch <= 2026.4.1.
Is there a fix for CVE-2026-50160?: A patch was published on 2026-04-21: Initial pull request for fix submitted Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50160 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-50160?: Check whether you run Hoppscotch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A mass assignment vulnerability exists in the 'POST /v1/onboarding/config' endpoint of hoppscotch-backend. The root cause is a combination of four weaknesses: the NestJS ValidationPipe is configured without 'whitelist: true', allowing extra request body properties to persist; the service layer iterates through these properties using 'Object.entries' without runtime validation; the 'validateEnvValues' function lacks explicit checks for sensitive keys (falling through to a default break); and the endpoint lacks authentication. An unauthenticated remote attacker can exploit this on fresh installations (where no users exist) to overwrite 'JWT_SECRET' and 'SESSION_SECRET'. By controlling the JWT signing key, the attacker can forge tokens for any user, including administrators, achieving full remote code execution or server compromise. The issue is resolved in version 2026.5.0 by enabling strict validation whitelisting and service-level allowlists.

Affected products

Hoppscotch hoppscotch-backend (Self-Hosted) <= 2026.4.1

Timeline

2026-04-21: patched: Initial pull request for fix submitted
2026-05-28: advisory: GitHub Security Advisory published
2026-06-23: disclosed: Public disclosure on oss-security mailing list
2026-07-01: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.