---
id: "CVE-2026-126271"
page: "https://infrastack.ai/live/CVE-2026-126271"
kind: "vulnerability"
aliases: ["CVE-2026-126271"]
title: "NocoDB: base viewers can read database TLS private keys"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["external-database", "nocodb", "other", "self-hosted", "tls"]
not_affected_if: ["fixed-version", "managed-hosting", "no-tls-client-certs"]
published_at: "2026-11-13T10:17:29+00:00"
first_seen_at: "2026-11-13T10:47:12+00:00"
updated_at: "2026-11-13T10:51:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126271", "first_seen_at": "2026-11-13T10:47:12+00:00"}]
exploit_sources: []
---

# NocoDB: base viewers can read database TLS private keys

Link for people: https://infrastack.ai/live/CVE-2026-126271 (this .md is for agents)

NocoDB before 2026.09.0 lets an authenticated base Viewer read a base's data source and obtain the decrypted TLS client private key, client certificate and CA certificate. An attacker can use these to connect straight to the external database and bypass NocoDB permissions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the NocoDB version in use; affected versions are those before `2026.09.0`.
- Review which users hold the Viewer role on bases that connect to external databases with TLS client certificates.

## Fix

- Upgrade NocoDB to `2026.09.0` or later.

## Timeline

- 2026-11-13T10:47:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126271

## Documents

- [advisory] Vendor advisory: github.com https://github.com/nocodb/nocodb/security/advisories/GHSA-rjc4-j36j-gjjc
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/nocodb-before-2026.09.0-tls-private-key-exposure-via-data-source-read

## From the sources

NocoDB before 2026.09.0 contains an information disclosure vulnerability that allows authenticated base Viewers to obtain TLS client private keys by reading a base's data source. The source read handler masked only the connection password, letting attackers retrieve the decrypted private key, client certificate and CA to connect directly to the external database, bypassing NocoDB permissions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_