CVE-2026-34932 is a critical stored cross-site scripting flaw in Hoppscotch, an open source API development tool. NVD scores it 9.3. The record says it can lead to cross-site request forgery. Upgrade to Hoppscotch 2026.3.0 or later. Self hosted teams should patch both Hoppscotch issues together.
What's affected
Hoppscotch before 2026.3.0. The fixed release is 2026.3.0.
The record is short, so read the GitHub advisory for the affected component before you scope the work.
How to check if you're exposed
For a self hosted instance, check the version in the app footer or the image tag, and compare with 2026.3.0.
docker images | grep -i hoppscotch
What to do now
- Upgrade to Hoppscotch 2026.3.0 or later.
- Review shared collections and workspaces for content that was added by people you do not know.
- Limit who can share content into team workspaces.
- Rotate secrets stored in shared environments if you see anything suspicious.
Why it matters
The weakness is CWE-79, cross-site scripting, in its stored form. Content saved in the app runs in another user's browser when they open it. Once script runs inside the app, it can send requests as that user, which is the CSRF the record mentions.
This CVE was published alongside the open redirect CVE-2026-34931, and both are fixed in 2026.3.0, so one upgrade handles both.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Stored XSS in an API client deserves attention because the app often holds tokens, environment variables and saved requests that point at internal services. Script running in that context can act with the victim's access. Review who can publish shared collections, and remove content from authors you cannot identify. After you upgrade, spot check a few shared workspaces to confirm nothing odd remains.
Quick check
Is it the same fix as the open redirect?
Yes, both name 2026.3.0.
Sources
Last reviewed: 19 October 2026.
