NOCODB · CVE-2026-126281 · Package
NO FIX YET · SEE WHAT TO DO
NocoDB before 2026.08.0 does not check ownership or the private flag when creating an integration from an existing one, so the copy step decrypts another user's stored credentials. An authenticated user with the Creator role can read another user's database host, username and password by guessing or enumerating integration ids.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted or cloud NocoDB deployments before 2026.08.0 where users hold the Creator role and share a workspace with integrations containing database credentials. Instances where only trusted users can create integrations have much less exposure.
Not affected if single-trusted-user, version-2026.08.0-or-later
Who cares database-credentials, nocodb, self-hosted
2026.08.0 are in range.2026.08.0 or later.NocoDB before 2026.08.0 contains a missing authorization vulnerability in the copy-from branch of integration creation in integrations.service.ts that decrypts a source integration's connection credentials without checking its owner or private flag. Authenticated users with the Creator role can supply guessed or enumerated integration ids to copy other users' private database host, username, and password into an integration they own.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.