Nhost is an open source Firebase alternative with GraphQL. In its CLI tool, a hidden `nhost configserver` endpoint is exposed in versions prior to 1.46.0. The endpoint implements the Mimir GraphQL API with dummy authorization directives and permissive CORS, making it accessible without authentication. Consequently, any process that can reach the developer’s localhost service—including a malicious web page served from an arbitrary origin—can query or mutate the configserver, reading project secrets such as JWT signing keys, webhook secrets, Grafana credentials, and custom environment variables, and injecting attacker-controlled credentials into the local `.secrets` file, thereby compromising confidentiality and integrity of the local development environment.

The vulnerability affects the Nhost CLI product; all releases before 1.46.0 are impacted. The issue only manifests when developers run the local development environment using the `nhost dev` command.

The CVSS base score of 5.4 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of active exploitation. This vulnerability is not listed in CISA KEV. Attackers can exploit the flaw remotely from any process able to reach the local dev server on localhost; a malicious web page from a different origin can send HTTP requests to the exposed GraphQL endpoint, reading or writing configuration data without authentication.