Nhost Local MCP Server Unauthenticated CORS Bypass Leading to Full Project Takeover (CVE-2026-34200)

Metadata

Affected Target

Summary

The Nhost CLI’s local MCP server, used to let AI agents/tools manage a developer’s Nhost project, has no inbound authentication and inherits a permissive Access-Control-Allow-Origin: * CORS policy from the underlying mcp-go library. Because the server does not strictly validate the Content-Type header on its JSON-RPC message endpoint, an attacker-controlled web page can send a Content-Type: text/plain POST request that qualifies as a CORS “simple request,” letting the browser skip the preflight OPTIONS check entirely. A malicious page can first open a cross-origin EventSource connection to the server’s /sse endpoint to capture a live session ID, then POST an MCP tools/call request (e.g. graphql-query or manage-graphql) using that session, since the server holds the developer’s actual Admin Secret/PAT and attaches it to outbound requests on the caller’s behalf. The included PoC is a self-contained HTML/JS page that, when opened by a victim with the MCP server running, silently connects to http://127.0.0.1:8080/sse, steals the session endpoint, and issues a list_sessions_and_beacons tool call to demonstrate data exfiltration.

Vulnerability Details

Root Cause

The local MCP server combines a hardcoded wildcard CORS policy (Access-Control-Allow-Origin: *) with a lack of Content-Type enforcement on its JSON-RPC endpoint, allowing cross-origin “simple requests” to bypass the browser’s CORS preflight; combined with zero inbound authentication, any page the victim visits can issue arbitrary MCP tool calls carrying the developer’s privileged Admin Secret/PAT.

Attack Vector

1. Victim developer runs nhost mcp start (or equivalent), starting the local MCP server on localhost:8080 (or 0.0.0.0 in shared-access configurations).
2. Victim visits an attacker-controlled web page while the MCP server is active.
3. The page opens a cross-origin EventSource to http://127.0.0.1:8080/sse; the browser allows this because of the wildcard CORS header, and the page captures the session’s endpoint event containing a session ID.
4. The page issues a fetch() POST with mode: "no-cors" and Content-Type: text/plain to the captured endpoint, carrying a JSON-RPC tools/call payload (e.g. graphql-query, manage-graphql); this qualifies as a CORS simple request and bypasses preflight.
5. The MCP server executes the tool call using the developer’s locally configured Admin Secret/PAT and streams the result back over the same SSE connection, which the malicious page reads to exfiltrate data.

Impact

Complete compromise of the developer’s Nhost project(s): exfiltration of production database contents, arbitrary SQL migrations/table drops via Hasura metadata management, rewriting of Hasura permissions, and hijacking of the developer’s Cloud PAT/Admin Secret — all from a single, silent page visit with no further user interaction.

Environment / Lab Setup

Target:   Nhost CLI local MCP server (nhost mcp start --bind localhost:8080), configured with a project
Attacker: Any web browser reachable by the victim; a hosted HTML/JS page (exploit.ts) served from any origin

Proof of Concept

PoC Script

See exploit.ts in this folder.

1

python3 -m http.server 9000

Despite the .ts extension, the file is a self-contained HTML/JavaScript page: it opens an EventSource to the victim’s local MCP server, captures the session endpoint from the endpoint SSE event, and sends a crafted text/plain JSON-RPC POST request invoking the list_sessions_and_beacons MCP tool, displaying any exfiltrated data returned over the SSE stream in the page’s log/output panel.

Detection & Indicators of Compromise

Signs of compromise:

• Requests to the local MCP server’s /sse or /message endpoints originating from browser tabs/pages not belonging to the Nhost tooling itself
• MCP tool-call logs showing graphql-query or manage-graphql invocations correlated with a browser session rather than a CLI/IDE integration
• Unexpected Hasura metadata changes or SQL migrations shortly after a developer browsed to an unfamiliar site while nhost mcp start was running

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/skoveit/CVE-2026-34200 on 2026-07-05.