CVE-2026-47671

Name of the Vulnerable Software and Affected Versions Nhost CLI (affected versions not specified)

Description The hidden configserver used by nhost dev exposes the Mimir GraphQL API with permissive CORS and dummy authorization directives. This allows any process capable of reaching the developer's localhost service, including a web page loaded from an arbitrary origin, to perform unauthenticated queries and mutations. An attacker can read sensitive local development configuration and secrets, such as project admin secrets, JWT signing keys, webhook secrets, Grafana credentials, and custom environment variables. Additionally, the attacker can mutate the local .secrets file to inject attacker-controlled secrets.

The issue is facilitated by the use of a fixed zero UUID app ID and the replacement of role and app-visibility directives with no-op handlers. The vulnerable GraphQL endpoint is /v1/configserver/graphql, and the affected variables include appID and the contents of the .secrets file.

Recommendations Restrict CORS to only allow the dashboard origin. Replace the fixed zero UUID app ID with a randomly generated UUIDv4 per project. Implement in-memory secret redaction to ensure that read paths return placeholders instead of real secret values.