NOCODB · CVE-2026-126278 · Package
NO FIX YET · SEE WHAT TO DO
NocoDB before 2026.08.1 has a race condition in its password reset code, so someone holding a valid reset token can send concurrent requests and set the password several times. The window opens during slow bcrypt hashing before the token is cleared, letting an attacker overwrite the owner's new password and lock them out.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host NocoDB before 2026.08.1 and allow password reset. Exploitation requires a valid reset token, so instances with no reset flow in use face less exposure. Hosted or managed NocoDB is handled by the vendor.
Not affected if managed-hosting, reset-disabled
Who cares nocodb, password-reset, self-hosted
2026.08.1; anything lower is in range.2026.08.1 or later.NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid reset token to perform multiple password changes by sending concurrent reset requests. Attackers can exploit the window created by slow bcrypt hashing before the token is cleared to overwrite the owner's new password and lock them out.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.