CVE-2026-34200: 
NixOS vulnerability analysis and mitigation

CVE-2026-34200 is a missing authentication and permissive CORS vulnerability in the Nhost CLI MCP server that allows a malicious website to issue cross-origin requests to the locally running MCP server and invoke privileged tools using the developer's credentials. It affects Nhost CLI versions up to and including 1.40.0; version 1.41.0 contains the fix. The vulnerability was published on March 31, 2026, with the patch merged on March 26, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, Red Hat).

The root cause is twofold, classified under CWE-306 (Missing Authentication for Critical Function) and CWE-942 (Permissive Cross-domain Policy with Untrusted Domains). When the Nhost CLI MCP server is started with the --bind flag (e.g., nhost mcp start --bind localhost:8080), the underlying mcp-go library hardcodes Access-Control-Allow-Origin: * on SSE and message endpoints, and the server does not strictly validate the Content-Type header on inbound JSON-RPC requests. This allows an attacker to send a POST with Content-Type: text/plain — a "simple request" that browsers dispatch cross-origin without triggering a CORS preflight — to invoke any registered MCP tool without authentication. Exploitation requires two non-default configuration steps: (1) explicitly binding the server to a network port via --bind, and (2) optionally running nhost mcp config to enable cloud credentials for the most severe attack scenarios (GitHub Advisory).

When both preconditions are met, a malicious website visited by the developer on the same machine can read or modify project data via graphql-query (operating as admin), exfiltrate or mutate cloud project data via cloud-graphql-query using the developer's Personal Access Token (PAT), and execute raw SQL migrations or drop tables via manage-graphql. Impact is scoped to the specific project the developer has configured and does not affect other developers or projects, but within that scope the attacker achieves full project takeover including credential hijacking (PAT/Admin Secret), database exfiltration, and destructive schema changes (GitHub Advisory).

1. Reconnaissance: Identify a developer machine running nhost mcp start --bind localhost:8080 (or any port), confirming the MCP server is network-bound by checking for an open local port or observing Access-Control-Allow-Origin: * in the SSE response headers via curl localhost:8080/sse -i.
2. Establish SSE connection: Host a malicious webpage that opens an EventSource connection to http://localhost:<port>/sse to capture the MCP session endpoint (e.g., /message?sessionId=<uuid>) from the endpoint event.
3. Craft JSON-RPC payload: Construct a JSON-RPC 2.0 request targeting a privileged MCP tool such as graphql-query (with role: "admin") or cloud-graphql-query to exfiltrate data, or manage-graphql to execute raw SQL.
4. Bypass CORS preflight: Send the payload via fetch() with mode: "no-cors" and Content-Type: text/plain to the captured session endpoint. This bypasses CORS preflight checks because text/plain is a browser "simple request" content type.
5. Receive exfiltrated data: Listen for the message SSE event on the established connection to receive the JSON-RPC response containing query results, user data, or confirmation of destructive actions (table drops, permission changes, credential access) (GitHub Advisory, PoC Repo).

• Network: Unexpected inbound HTTP connections to localhost on non-standard ports (e.g., 8080) from browser processes; outbound connections from the MCP server process to unknown cloud endpoints following a browser visit.
• Logs: HTTP access logs for the MCP server showing POST requests to /message?sessionId=<uuid> with Content-Type: text/plain from browser-originated connections; SSE connections to /sse from localhost originating from a browser user agent.
• Process: The nhost CLI process spawned with --bind flag visible in process listings (e.g., ps aux | grep nhost); unexpected GraphQL mutations or Hasura metadata API calls (/apis/migrate) in application or cloud audit logs shortly after a developer browsed an external site.
• File System: Unexpected changes to Hasura migration files or metadata if manage-graphql was invoked; new or modified permission rules in the Hasura configuration (GitHub Advisory).

Upgrade Nhost CLI to version 1.41.0 or later, which removes the --bind flag entirely and restricts the MCP server to stdio-only communication, eliminating the network attack surface (PR #4060, commit 15eae92). As an immediate workaround for those who cannot upgrade, do not start the MCP server with the --bind flag; the default nhost mcp start (stdio mode) is not affected by this vulnerability. Developers should also avoid running nhost mcp config to enable cloud credentials unless strictly necessary, as this limits the blast radius even if the server is inadvertently exposed (GitHub Advisory, Fix PR).

The vulnerability was reported by security researcher skoveit, who also published the proof-of-concept exploit repository. The Nhost maintainer dbarrosop responded promptly by merging a fix (PR #4060) on the same day the advisory was published (March 26, 2026), choosing to completely remove the --bind network binding capability rather than add authentication, reflecting a security-by-design approach. No broader media coverage or significant social media discussion has been identified beyond the GitHub advisory and PoC repository (GitHub Advisory, Fix PR).