---
id: "CVE-2026-126278"
page: "https://infrastack.ai/live/CVE-2026-126278"
kind: "vulnerability"
aliases: ["CVE-2026-126278"]
title: "NocoDB: race in password reset lets a token holder lock out owners"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "NocoDB", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"via": "cpe", "name": "nocodb", "fixed": [], "affected": "", "ecosystem": "npm"}]
ecosystems: ["npm", "vendor"]
tags: ["nocodb", "package", "password-reset", "self-hosted"]
not_affected_if: ["managed-hosting", "reset-disabled"]
published_at: "2026-11-13T10:17:31+00:00"
first_seen_at: "2026-11-13T10:47:13+00:00"
updated_at: "2026-11-13T11:20:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126278", "first_seen_at": "2026-11-13T10:47:13+00:00"}]
exploit_sources: []
---

# NocoDB: race in password reset lets a token holder lock out owners

Link for people: https://infrastack.ai/live/CVE-2026-126278 (this .md is for agents)

NocoDB before 2026.08.1 has a race condition in its password reset code, so someone holding a valid reset token can send concurrent requests and set the password several times. The window opens during slow bcrypt hashing before the token is cleared, letting an attacker overwrite the owner's new password and lock them out.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NocoDB affected range not listed fixed no fixed version listed
- npm:nocodb affected range not listed fixed no fixed version listed

## How to check

- Check the running NocoDB version against `2026.08.1`; anything lower is in range.
- Review whether password reset is enabled for your instance (unknown from sources whether it is on by default).

## Fix

- NocoDB: move to `2026.08.1` or later.

## Timeline

- 2026-11-13T10:47:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126278

## Documents

- [advisory] Vendor advisory: github.com https://github.com/nocodb/nocodb/security/advisories/GHSA-7mf9-q77p-r4r3
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/nocodb-before-2026.08.1-password-reset-token-race-condition

## From the sources

NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid reset token to perform multiple password changes by sending concurrent reset requests. Attackers can exploit the window created by slow bcrypt hashing before the token is cleared to overwrite the owner's new password and lock them out.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_