{"id":"CVE-2026-126273","kind":"vulnerability","aliases":["CVE-2026-126273"],"related":[],"title":"NocoDB: empty admin password lets a stranger sign up as super admin","description":"NocoDB before 2026.09.0 contains a privilege escalation vulnerability in initAdminFromEnv.ts that silently skips super-admin bootstrap when the admin password environment variable is empty. Unauthenticated attackers can call the public signup endpoint first on a fresh instance to receive Creator and Super Admin roles, gaining full administrative control.","summary":"NocoDB skips creating its super-admin account when the admin password environment variable is empty. On a fresh instance, an unauthenticated attacker can call the public signup endpoint first and receive Creator and Super Admin roles, which gives full administrative control.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"nocodb","fixed":[],"affected":"","ecosystem":"vendor"},{"via":"cpe","name":"nocodb","fixed":[],"affected":"","ecosystem":"npm"}],"ecosystems":["npm","vendor"],"tags":["docker","nocodb","package","self-hosted"],"not_affected_if":["admin-password-set","already-initialized","managed-hosting"],"how_to_check":"- Check the NocoDB version with the running image or package; affected versions are those before `2026.09.0`.\n- Look for the admin password environment variable in your deployment config; if it is empty or unset on a fresh install, the instance is at risk.\n- Check whether a super-admin account exists that you did not create.","fix":"- NocoDB versions before `2026.09.0`: move to `2026.09.0` or later.","status":"open","published_at":"2026-11-13T10:17:30+00:00","first_seen_at":"2026-11-13T10:47:12+00:00","triaged_at":"2026-11-13T10:48:37+00:00","updated_at":"2026-11-13T11:20:09+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:48:37Z","model":"claude-haiku-5-5","output":{"fix":"- NocoDB versions before `2026.09.0`: move to `2026.09.0` or later.","reach":"internet","title":"NocoDB: empty admin password lets a stranger sign up as super admin","impact":"high","summary":"NocoDB skips creating its super-admin account when the admin password environment variable is empty. On a fresh instance, an unauthenticated attacker can call the public signup endpoint first and receive Creator and Super Admin roles, which gives full administrative control.","audience":"businesses","category":"package","nicknames":[],"who_cares":["nocodb","self-hosted","docker"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated attacker gains full super-admin control of the instance","analyst_note":"Confirm the fixed version and the vendor advisory at github.com for the exact affected range; the sources give only 'before 2026.09.0'.","how_to_check":"- Check the NocoDB version with the running image or package; affected versions are those before `2026.09.0`.\n- Look for the admin password environment variable in your deployment config; if it is empty or unset on a fresh install, the instance is at risk.\n- Check whether a super-admin account exists that you did not create.","plain_action":"","product_name":"nocodb","needs_analyst":true,"not_affected_if":["admin-password-set","already-initialized","managed-hosting"],"who_is_affected":"Self-hosted NocoDB instances that were freshly deployed with an empty admin password environment variable, so the super-admin bootstrap was skipped and the public signup endpoint is open. Instances that already have an admin account, or that set the admin password, are not exposed through this path. Managed or already-initialized instances should be checked for unexpected super-admin accounts.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000789,"input_tokens":4622,"output_tokens":653,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126273':15A,18A '-2026':14A,17A '2026.09.0':71C 'account':34B 'admin':3A,12A,33B,37B,62B,84C,88C,112C 'administr':67B,116C 'attack':49B,95C 'bootstrap':85C 'call':51B,97C 'contain':72C 'control':68B,117C 'creat':29B 'creator':59B,109C 'cve':13A,16A 'docker':21B 'empti':2A,42B,93C 'endpoint':55B,101C 'environ':39B,90C 'escal':75C 'first':56B,102C 'fresh':45B,105C 'full':66B,115C 'gain':114C 'give':65B 'host':26B 'initadminfromenv.ts':78C 'instanc':46B,106C 'let':5A 'nocodb':1A,19A,20A,22B,27B,69C 'packag':23B 'password':4A,38B,89C 'privileg':74C 'public':53B,99C 'receiv':58B,108C 'role':63B,113C 'self':25B 'self-host':24B 'sign':8A 'signup':54B,100C 'silent':80C 'skip':28B,81C 'stranger':7A 'super':11A,32B,61B,83C,111C 'super-admin':31B,82C 'unauthent':48B,94C 'variabl':40B,91C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted NocoDB instances that were freshly deployed with an empty admin password environment variable, so the super-admin bootstrap was skipped and the public signup endpoint is open. Instances that already have an admin account, or that set the admin password, are not exposed through this path. Managed or already-initialized instances should be checked for unexpected super-admin accounts.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["nocodb"],"ptokens":["nocodb"],"labels":["critical","docker","nocodb","npm","package","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126273':15A,18A '-2026':14A,17A 'admin':3A,12A 'cve':13A,16A 'empti':2A 'let':5A 'nocodb':1A,19A,20A 'password':4A 'sign':8A 'stranger':7A 'super':11A","search_b":"'account':34B 'admin':33B,37B,62B 'administr':67B 'attack':49B 'call':51B 'control':68B 'creat':29B 'creator':59B 'docker':21B 'empti':42B 'endpoint':55B 'environ':39B 'first':56B 'fresh':45B 'full':66B 'give':65B 'host':26B 'instanc':46B 'nocodb':22B,27B 'packag':23B 'password':38B 'public':53B 'receiv':58B 'role':63B 'self':25B 'self-host':24B 'signup':54B 'skip':28B 'super':32B,61B 'super-admin':31B 'unauthent':48B 'variabl':40B","search_c":"'2026.09.0':71C 'admin':84C,88C,112C 'administr':116C 'attack':95C 'bootstrap':85C 'call':97C 'contain':72C 'control':117C 'creator':109C 'empti':93C 'endpoint':101C 'environ':90C 'escal':75C 'first':102C 'fresh':105C 'full':115C 'gain':114C 'initadminfromenv.ts':78C 'instanc':106C 'nocodb':69C 'password':89C 'privileg':74C 'public':99C 'receiv':108C 'role':113C 'signup':100C 'silent':80C 'skip':81C 'super':83C,111C 'super-admin':82C 'unauthent':94C 'variabl':91C 'vulner':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T10:06:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126273","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126273","severity":null,"published_at":"2026-11-13T10:17:30+00:00","modified_at":"2026-11-13T10:17:30+00:00","first_seen_at":"2026-11-13T10:47:12+00:00","fetched_at":"2026-11-13T10:47:12+00:00","note":null}],"documents":[{"id":144875,"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-mjxv-r6j7-m8gv","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T10:06:25+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144876,"url":"https://www.vulncheck.com/advisories/nocodb-before-2026.09.0-privilege-escalation-via-incomplete-admin-bootstrap","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}