What is the CVSS score of CVE-2026-28215?

CVE-2026-28215 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-28215?

Yes, a public proof-of-concept exploit is available for CVE-2026-28215. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-28215?

Within 24 hours: Identify all instances of Hoppscotch in your environment and isolate affected systems from production networks; assess which APIs and systems are accessible through compromised instances. Within 7 days: Implement network segmentation to restrict Hoppscotch access to authorized personnel only; deploy WAF rules to block malicious payloads targeting this vulnerability; monitor for exploitation attempts. Within 30 days: Evaluate alternative API development platforms; plan migration away from vulnerable Hoppscotch instances; monitor vendor communications for patch availability and deploy immediately upon release.

Hoppscotch CVE-2026-28215

CRITICAL

Improper Access Control (CWE-284)

2026-02-26 security-advisories@github.com

Github Hoppscotch

9.1

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send HTTP POST to /v1/onboarding/config endpoint
Exploit

Overwrite OAuth credentials and SMTP settings
Impact

Redirect authentication flows to attacker infrastructure

Vulnerability Assessment

Weakness	CWE CWE-284 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Access control enforcement MITRE ATT&CK 1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions — remote unauthenticated exploitation against self-hosted Hoppscotch instances prior to version 2026.2.0 with POST /v1/onboarding/config endpoint accessible without authentication guards.
Impact	CVSS 9.1. Hoppscotch is used by developers — infrastructure compromise exposes API keys and development environment configs.
Exploit ScenarioDerived	Attacker overwrites Hoppscotch infrastructure config to redirect API requests, intercept credentials, or inject malicious endpoints.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Unauthenticated infrastructure overwrite in Hoppscotch API development ecosystem before 2026.2.0. Attackers can overwrite the entire infrastructure configuration. PoC available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:56 CVSS 9.1

Unauthenticated config overwrite in Hoppscotch API tool.

RemediationAI

Update to Hoppscotch 2026.2.0.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-284 improper access control on infrastructure configuration endpoints. Unauthenticated attackers can overwrite critical settings.

Know when Hoppscotch gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

PoC Detected

Feb 27, 2026 - 15:53 vuln.today

Public exploit code

CVE Published

Feb 26, 2026 - 23:16 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, an unauthenticated attacker can overwrite the entire infrastructure configuration of a self-hosted Hoppscotch instance including OAuth provider credentials and SMTP settings by sending a single HTTP POST request with no authentication. The endpoint POST /v1/onboarding/config has no authentication guard and performs no check on whether onboarding was already completed. A successful exploit allows the attacker to replace the instance's Google/GitHub/Microsoft OAuth application credentials with their own, causing all subsequent user logins via SSO to authenticate against the attacker's OAuth app. The attacker captures OAuth tokens and email addresses of every user who logs in after the exploit. Additionally, the endpoint returns a recovery token that can be used to read all stored secrets in plaintext, including SMTP passwords and any other configured credentials. Version 2026.2.0 fixes the issue.

Executive ViewAI

Why It Matters

A critical vulnerability (CVSS 9.1) has been discovered in Hoppscotch, an open-source API development platform, with a public exploit available and no patch currently available. Organizations using Hoppscotch for API testing and development face immediate risk of unauthorized access, data exfiltration, and potential compromise of connected systems and APIs.

Business Impact: Severe

Compensating Controls

Implement network segmentation and restrict Hoppscotch access to isolated development networks only; deploy Web Application Firewall (WAF) rules to detect and block exploitation attempts; disable or restrict API export/import functionality if possible; require multi-factor authentication for Hoppscotch access; implement continuous monitoring and logging of all Hoppscotch activities; consider disabling Hoppscotch entirely until patch is available if APIs under test are business-critical; restrict outbound connections from Hoppscotch instances.

Threat Intelligence Overview

EPSS Score

0.1%

Top 79% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.