CVE-2026-47671 is a missing authentication vulnerability (CWE-306) in the Nhost CLI prior to version 1.46.0. The hidden 'nhost configserver' component, used during local development with 'nhost dev', exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS settings. This misconfiguration allows any process that can reach the localhost service, including web pages from arbitrary origins, to query and mutate sensitive local configuration and secrets. This includes reading project admin secrets, JWT signing keys, webhook secrets, Grafana credentials, and custom environment variables, as well as writing attacker-controlled secrets to the local project. The vulnerability is fixed in Nhost CLI version 1.46.0.

The vulnerability allows unauthorized local access to sensitive secrets and configuration data in the developer's local environment. Attackers able to reach the localhost service can read critical secrets and inject malicious secrets into the local project. This compromises the confidentiality and integrity of local development secrets, potentially leading to further compromise of development workflows or downstream deployments. There is no indication of impact on production or cloud-hosted environments. No known exploits in the wild have been reported.

A fix is available in Nhost CLI version 1.46.0. Users should upgrade to version 1.46.0 or later to remediate this vulnerability. Since this affects the local development environment, upgrading the CLI tool will prevent unauthorized access to the local configserver. No additional vendor advisory details were provided. Patch status is confirmed by the vendor stating version 1.46.0 contains the fix.