Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-47671 · Microsoft / collected KEV context

EUVD-2026-46393

GHSA-64cj-qvx5-m4f3

GO-2026-5166

cve-program · CVE-2026-47671

• https://github.com/nhost/nhost/security/advisories/GHSA-64cj-qvx5-m4f3
• https://github.com/nhost/nhost/pull/4302
• https://github.com/nhost/nhost/commit/e407511627d2c2c1137a70e9ca1ca31095d23479
• https://github.com/nhost/nhost/releases/tag/[email protected]

euvd · EUVD-2026-46393

• https://github.com/nhost/nhost/security/advisories/GHSA-64cj-qvx5-m4f3
• https://github.com/nhost/nhost/pull/4302
• https://github.com/nhost/nhost/commit/e407511627d2c2c1137a70e9ca1ca31095d23479
• https://github.com/nhost/nhost/releases/tag/[email protected]

nvd · CVE-2026-47671

• https://github.com/nhost/nhost/commit/e407511627d2c2c1137a70e9ca1ca31095d23479
• https://github.com/nhost/nhost/pull/4302
• https://github.com/nhost/nhost/releases/tag/[email protected]
• https://github.com/nhost/nhost/security/advisories/GHSA-64cj-qvx5-m4f3

osv · GHSA-64cj-qvx5-m4f3

• https://github.com/nhost/nhost/security/advisories/GHSA-64cj-qvx5-m4f3
• https://github.com/nhost/nhost/pull/4302
• https://github.com/nhost/nhost/commit/e407511627d2c2c1137a70e9ca1ca31095d23479
• https://github.com/nhost/nhost
• https://github.com/nhost/nhost/releases/tag/[email protected]

osv · GO-2026-5166

• https://github.com/nhost/nhost/security/advisories/GHSA-64cj-qvx5-m4f3
• https://github.com/nhost/nhost/commit/e407511627d2c2c1137a70e9ca1ca31095d23479
• https://github.com/nhost/nhost/pull/4302
• https://github.com/nhost/nhost/releases/tag/[email protected]

No related operational record is retained in the current change model.