NOCODB · CVE-2026-126273 · Package
NO FIX YET · SEE WHAT TO DO
NocoDB skips creating its super-admin account when the admin password environment variable is empty. On a fresh instance, an unauthenticated attacker can call the public signup endpoint first and receive Creator and Super Admin roles, which gives full administrative control.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted NocoDB instances that were freshly deployed with an empty admin password environment variable, so the super-admin bootstrap was skipped and the public signup endpoint is open. Instances that already have an admin account, or that set the admin password, are not exposed through this path. Managed or already-initialized instances should be checked for unexpected super-admin accounts.
Not affected if admin-password-set, already-initialized, managed-hosting
Who cares docker, nocodb, self-hosted
2026.09.0.2026.09.0: move to 2026.09.0 or later.NocoDB before 2026.09.0 contains a privilege escalation vulnerability in initAdminFromEnv.ts that silently skips super-admin bootstrap when the admin password environment variable is empty. Unauthenticated attackers can call the public signup endpoint first on a fresh instance to receive Creator and Super Admin roles, gaining full administrative control.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.