CVE-2026-50160 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-50160 requires immediate attention.

· 6 min read

Executive Summary

CVE-2026-50160 is a critical unauthenticated takeover issue in self-hosted Hoppscotch backend deployments. In hoppscotch-backend version 2026.4.1 and earlier, the onboarding endpoint POST /v1/onboarding/config accepts extra request fields that should be rejected. Because the app’s global validation is missing whitelist: true, an attacker can mass-assign sensitive config values such as JWT_SECRET and SESSION_SECRET before onboarding is complete or when no users exist.

That can let an attacker forge authentication tokens, impersonate administrators, and fully compromise the server. The issue is fixed in hoppscotch 2026.5.0. This is a drop-everything patch for any internet-reachable self-hosted instance.

Immediate Action

  • Patch immediately to hoppscotch 2026.5.0 or later. If you cannot patch within minutes, isolate the service from the internet.
  • Block unauthenticated access to /v1/onboarding/config at your reverse proxy or WAF until upgraded.
  • Assume secret exposure if the instance was reachable before onboarding finished. Rotate JWT_SECRET, SESSION_SECRET, and any related signing keys.
  • Invalidate sessions and force re-authentication after rotation.
  • Check vendor guidance and release notes: Vendor advisory / release notes

Affected Versions

  • hoppscotch-backend@<=2026.4.1 vulnerable
  • hoppscotch@<=2026.4.1 vulnerable in self-hosted deployments
  • hoppscotch@2026.5.0 and later safe
  • If you deploy via Docker, any image tag based on 2026.4.1 or earlier is vulnerable

Resolution Guide

JavaScript / npm

npm install hoppscotch-backend@2026.5.0
# or, if your package is named differently:
npm install hoppscotch@2026.5.0

npm audit

Yarn

yarn add hoppscotch-backend@2026.5.0
yarn audit

pnpm

pnpm add hoppscotch-backend@2026.5.0
pnpm audit

Python / pip / pipx (only if you wrap or vendor the service in Python tooling)

pip install --upgrade hoppscotch-backend==2026.5.0
pipx upgrade hoppscotch-backend

Java / Maven / Gradle (only if your build consumes a packaged backend artifact)

# Maven
mvn versions:use-latest-releases

# Gradle
./gradlew dependencyUpdates

Linux packages

# apt
sudo apt update
sudo apt install --only-upgrade hoppscotch-backend

# yum/dnf
sudo yum update hoppscotch-backend
# or
sudo dnf upgrade hoppscotch-backend

Docker

docker pull hoppscotch/hoppscotch-backend:2026.5.0
docker stop hoppscotch-backend
docker rm hoppscotch-backend
docker run -d --name hoppscotch-backend hoppscotch/hoppscotch-backend:2026.5.0

Hardening while you patch

# Block onboarding endpoint at the proxy
location = /v1/onboarding/config {
  deny all;
}

# If you control the NestJS app config, enable strict validation
app.useGlobalPipes(new ValidationPipe({
  whitelist: true,
  forbidNonWhitelisted: true,
}));

Minimal code fix example for the vulnerable validation path:

// Before
app.useGlobalPipes(new ValidationPipe());

// After
app.useGlobalPipes(new ValidationPipe({
  whitelist: true,
  forbidNonWhitelisted: true,
  transform: true,
}));

Detection & Verification

Check installed version

npm ls hoppscotch-backend
# or
cat package.json | grep -E '"hoppscotch(-backend)?"'
# Docker
docker inspect --format='{{.Config.Image}}' hoppscotch-backend

Look for the vulnerable validation pattern

grep -R "new ValidationPipe" -n .
grep -R "whitelist: true" -n .
grep -R "SaveOnboardingConfigRequest" -n .

Confirm the onboarding endpoint is exposed

curl -i https://YOUR-HOST/v1/onboarding/config

Test whether extra fields are rejected after patching:

curl -s -X POST https://YOUR-HOST/v1/onboarding/config \
  -H 'Content-Type: application/json' \
  -d '{"JWT_SECRET":"test","unexpected":"value"}' -i

Expected result after fix: the request should fail or ignore unknown fields, and sensitive config values should not be overwritten.

Verify secrets were not changed

# Check DB/config store for current values
# Replace with your actual datastore query:
SELECT key, value FROM infra_config WHERE key IN ('JWT_SECRET','SESSION_SECRET');

Dependency audit

npm audit --production
yarn audit
pnpm audit

Risk and Impact

This flaw can give an unauthenticated attacker control of the JWT signing secret on a fresh or uninitialized self-hosted Hoppscotch instance. Once the attacker can mint valid tokens, they can impersonate any user, including administrators, and take over the application.

The blast radius includes leaked API collections, environment settings, user accounts, and any downstream systems trusted through Hoppscotch-managed access. If the service was reachable from the internet before onboarding completed, treat it as potentially compromised and rotate secrets immediately.

Keep reading