Critical Mass Assignment Flaw in Hoppscotch Exposes API Secrets
Overview
CVE-2026-50160 is a CVSS 10.0 vulnerability in self-hosted Hoppscotch deployments, enabling unauthenticated attackers to overwrite critical secrets during onboarding. This flaw could allow full compromise of API infrastructure through simple request manipulation.
Technical Analysis
The vulnerability stems from a misconfigured NestJS ValidationPipe missing the 'whitelist: true' option, enabling mass assignment attacks via the /v1/onboarding/config endpoint. Attackers can inject arbitrary InfraConfig properties like JWT_SECRET and SESSION_SECRET into the database before user creation. Exploitation requires access to a fresh instance but yields persistent secret overwrites that bypass authentication in affected deployments.
Enterprise & DIB Impact
Defense Industrial Base (DIB) entities and enterprises using self-hosted Hoppscotch API platforms face immediate risk of secret key exposure, credential theft, and lateral movement. Compromised JWT/SESSION secrets could enable unauthorized access to sensitive systems and data exchanges in mission-critical environments.
Recommended Actions
- Apply the 2026.4.2 patch immediately for hoppscotch-backend
- enforce whitelist validation for all DTOs using NestJS @Expose() decorators
- restrict /v1/onboarding/config access to trusted networks
- monitor database write operations for unexpected secret changes
- and rotate all infrastructure secrets after mitigation
Need Help Assessing Your Exposure?
Axiom Cyber Research provides vulnerability assessment, red team operations, and security advisory services to the Defense Industrial Base and regulated sectors.
Schedule a ConsultationFull security advisory on 247alerts.net →