{"id":"CVE-2026-126271","kind":"vulnerability","aliases":["CVE-2026-126271"],"related":[],"title":"NocoDB: base viewers can read database TLS private keys","description":"NocoDB before 2026.09.0 contains an information disclosure vulnerability that allows authenticated base Viewers to obtain TLS client private keys by reading a base's data source. The source read handler masked only the connection password, letting attackers retrieve the decrypted private key, client certificate and CA to connect directly to the external database, bypassing NocoDB permissions.","summary":"NocoDB before 2026.09.0 lets an authenticated base Viewer read a base's data source and obtain the decrypted TLS client private key, client certificate and CA certificate. An attacker can use these to connect straight to the external database and bypass NocoDB permissions.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["external-database","nocodb","other","self-hosted","tls"],"not_affected_if":["fixed-version","managed-hosting","no-tls-client-certs"],"how_to_check":"- Check the NocoDB version in use; affected versions are those before `2026.09.0`.\n- Review which users hold the Viewer role on bases that connect to external databases with TLS client certificates.","fix":"- Upgrade NocoDB to `2026.09.0` or later.","status":"open","published_at":"2026-11-13T10:17:29+00:00","first_seen_at":"2026-11-13T10:47:12+00:00","triaged_at":"2026-11-13T10:51:12+00:00","updated_at":"2026-11-13T10:51:12+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-13T10:51:12Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade NocoDB to `2026.09.0` or later.","reach":"network","title":"NocoDB: base viewers can read database TLS private keys","impact":"high","summary":"NocoDB before 2026.09.0 lets an authenticated base Viewer read a base's data source and obtain the decrypted TLS client private key, client certificate and CA certificate. An attacker can use these to connect straight to the external database and bypass NocoDB permissions.","audience":"businesses","category":"other","nicknames":[],"who_cares":["nocodb","self-hosted","external-database","tls"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"attacker reads TLS private keys and connects directly to external databases","analyst_note":"","how_to_check":"- Check the NocoDB version in use; affected versions are those before `2026.09.0`.\n- Review which users hold the Viewer role on bases that connect to external databases with TLS client certificates.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","no-tls-client-certs","managed-hosting"],"who_is_affected":"Self-hosted or cloud NocoDB deployments before 2026.09.0 where bases connect to external databases using TLS client certificates. Anyone holding a Viewer role on such a base can read the key material, so the risk is greatest where many people have view access. Installations on 2026.09.0 or later, or without client-certificate data sources, are not exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000734,"input_tokens":4614,"output_tokens":546,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126271':12A,15A '-2026':11A,14A '2026.09.0':27B,70C 'allow':77C 'attack':53B,104C 'authent':30B,78C 'base':2A,31B,35B,79C,90C 'bypass':65B,121C 'ca':50B,113C 'certif':48B,51B,111C 'client':44B,47B,84C,110C 'connect':58B,101C,115C 'contain':71C 'cve':10A,13A 'data':37B,92C 'databas':6A,18B,63B,120C 'decrypt':42B,107C 'direct':116C 'disclosur':74C 'extern':17B,62B,119C 'external-databas':16B 'handler':97C 'host':23B 'inform':73C 'key':9A,46B,86C,109C 'let':28B,103C 'mask':98C 'nocodb':1A,19B,25B,66B,68C,122C 'obtain':40B,82C 'password':102C 'permiss':67B,123C 'privat':8A,45B,85C,108C 'read':5A,33B,88C,96C 'retriev':105C 'self':22B 'self-host':21B 'sourc':38B,93C,95C 'straight':59B 'tls':7A,24B,43B,83C 'use':55B 'viewer':3A,32B,80C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or cloud NocoDB deployments before 2026.09.0 where bases connect to external databases using TLS client certificates. Anyone holding a Viewer role on such a base can read the key material, so the risk is greatest where many people have view access. Installations on 2026.09.0 or later, or without client-certificate data sources, are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["externaldatabase","high","nocodb","other","selfhosted","tls"],"campaign_type":null,"search_a":"'-126271':12A,15A '-2026':11A,14A 'base':2A 'cve':10A,13A 'databas':6A 'key':9A 'nocodb':1A 'privat':8A 'read':5A 'tls':7A 'viewer':3A","search_b":"'2026.09.0':27B 'attack':53B 'authent':30B 'base':31B,35B 'bypass':65B 'ca':50B 'certif':48B,51B 'client':44B,47B 'connect':58B 'data':37B 'databas':18B,63B 'decrypt':42B 'extern':17B,62B 'external-databas':16B 'host':23B 'key':46B 'let':28B 'nocodb':19B,25B,66B 'obtain':40B 'permiss':67B 'privat':45B 'read':33B 'self':22B 'self-host':21B 'sourc':38B 'straight':59B 'tls':24B,43B 'use':55B 'viewer':32B","search_c":"'2026.09.0':70C 'allow':77C 'attack':104C 'authent':78C 'base':79C,90C 'bypass':121C 'ca':113C 'certif':111C 'client':84C,110C 'connect':101C,115C 'contain':71C 'data':92C 'databas':120C 'decrypt':107C 'direct':116C 'disclosur':74C 'extern':119C 'handler':97C 'inform':73C 'key':86C,109C 'let':103C 'mask':98C 'nocodb':68C,122C 'obtain':82C 'password':102C 'permiss':123C 'privat':85C,108C 'read':88C,96C 'retriev':105C 'sourc':93C,95C 'tls':83C 'viewer':80C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T10:06:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126271","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126271","severity":null,"published_at":"2026-11-13T10:17:29+00:00","modified_at":"2026-11-13T10:17:29+00:00","first_seen_at":"2026-11-13T10:47:12+00:00","fetched_at":"2026-11-13T10:47:12+00:00","note":null}],"documents":[{"id":144871,"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-rjc4-j36j-gjjc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T10:06:38+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144872,"url":"https://www.vulncheck.com/advisories/nocodb-before-2026.09.0-tls-private-key-exposure-via-data-source-read","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}