CVE-2026-126271 · Other
NO FIX YET · SEE WHAT TO DO
NocoDB before 2026.09.0 lets an authenticated base Viewer read a base's data source and obtain the decrypted TLS client private key, client certificate and CA certificate. An attacker can use these to connect straight to the external database and bypass NocoDB permissions.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted or cloud NocoDB deployments before 2026.09.0 where bases connect to external databases using TLS client certificates. Anyone holding a Viewer role on such a base can read the key material, so the risk is greatest where many people have view access. Installations on 2026.09.0 or later, or without client-certificate data sources, are not exposed.
Not affected if fixed-version, managed-hosting, no-tls-client-certs
Who cares external-database, nocodb, self-hosted, tls
2026.09.0.2026.09.0 or later.NocoDB before 2026.09.0 contains an information disclosure vulnerability that allows authenticated base Viewers to obtain TLS client private keys by reading a base's data source. The source read handler masked only the connection password, letting attackers retrieve the decrypted private key, client certificate and CA to connect directly to the external database, bypassing NocoDB permissions.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.