---
id: "CVE-2026-126281"
page: "https://infrastack.ai/live/CVE-2026-126281"
kind: "vulnerability"
aliases: ["CVE-2026-126281"]
title: "NocoDB: integration copy leaks other users' private database credentials to Creators"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "NocoDB", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"via": "cpe", "name": "nocodb", "fixed": [], "affected": "", "ecosystem": "npm"}]
ecosystems: ["npm", "vendor"]
tags: ["database-credentials", "nocodb", "package", "self-hosted"]
not_affected_if: ["single-trusted-user", "version-2026.08.0-or-later"]
published_at: "2026-11-13T10:17:31+00:00"
first_seen_at: "2026-11-13T10:47:13+00:00"
updated_at: "2026-11-13T11:20:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126281", "first_seen_at": "2026-11-13T10:47:13+00:00"}]
exploit_sources: []
---

# NocoDB: integration copy leaks other users' private database credentials to Creators

Link for people: https://infrastack.ai/live/CVE-2026-126281 (this .md is for agents)

NocoDB before 2026.08.0 does not check ownership or the private flag when creating an integration from an existing one, so the copy step decrypts another user's stored credentials. An authenticated user with the Creator role can read another user's database host, username and password by guessing or enumerating integration ids.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NocoDB affected range not listed fixed no fixed version listed
- npm:nocodb affected range not listed fixed no fixed version listed

## How to check

- Check the NocoDB version in use; versions before `2026.08.0` are in range.
- Review which accounts hold the Creator role, since they are the ones who can trigger the copy.
- Look for integrations marked private that other users could copy.

## Fix

- NocoDB: move to `2026.08.0` or later.

## Timeline

- 2026-11-13T10:47:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126281

## Documents

- [advisory] Vendor advisory: github.com https://github.com/nocodb/nocodb/security/advisories/GHSA-355h-p2mj-vwc9
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-private-integration-credential-exposure-via-copy

## From the sources

NocoDB before 2026.08.0 contains a missing authorization vulnerability in the copy-from branch of integration creation in integrations.service.ts that decrypts a source integration's connection credentials without checking its owner or private flag. Authenticated users with the Creator role can supply guessed or enumerated integration ids to copy other users' private database host, username, and password into an integration they own.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_