CVE-2026-126283 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
NocoDB before 2026.08.0 does not store or check the base a token was issued for, so a base-scoped API token works as an account-wide credential. An attacker holding a leaked token can read, change and delete records in every base the token owner belongs to, including bases joined later.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host or use NocoDB and issue API tokens scoped to a single base. Anyone holding such a token, or a token that has leaked, can reach the other bases of the token owner. Instances already on 2026.08.0 or later are not affected by this flaw.
Not affected if no-api-tokens, version-2026.08.0-or-later
Who cares api-tokens, nocodb, self-hosted
unknown in the running instance; the sources do not give a command.2026.08.0 or later.NocoDB before 2026.08.0 contains an incorrect authorization vulnerability that lets base-scoped API tokens act as account-wide credentials because the token's base_id is never stored or checked. Attackers holding a leaked token can read, write and delete records on every base the token owner belongs to, including bases joined later.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.