NOCODB · CVE-2026-126280 · Package
NO FIX YET · SEE WHAT TO DO
NocoDB before 2026.08.0 has a race condition in refresh-token rotation, because the code never checks how many rows an update touched. An attacker holding a captured refresh token can present it concurrently with the legitimate user and obtain a valid authenticated session, with no reuse event recorded.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted or managed NocoDB instances before 2026.08.0 that issue refresh tokens to users. Attackers need a captured refresh token, so exposure depends on how tokens are stored and transmitted. Teams on managed hosting or on versions at or after 2026.08.0 can skip it.
Not affected if version-2026.08.0-or-later
Who cares auth, nocodb, self-hosted
2026.08.0.2026.08.0 or later.NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens because UserRefreshToken.ts never checks the affected-row count. Attackers holding a captured refresh token can present it concurrently with the legitimate user to obtain a valid authenticated session, and no reuse event is recorded.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.