CVE-2026-126287 · Other
NO FIX YET · SEE WHAT TO DO
NocoDB before 2026.06.2 has a race condition in its OAuth token service, where a refresh token can be presented concurrently during non-atomic rotation. An attacker holding a captured refresh token can obtain their own access and refresh tokens and keep scoped access without triggering reuse detection.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
NocoDB instances before 2026.06.2 that use OAuth refresh tokens are exposed. An attacker must already hold a captured refresh token, so the risk is to self-hosted or managed NocoDB deployments that issue OAuth tokens to clients. Instances without OAuth token issuance have less exposure.
Not affected if no-oauth-clients, nocodb-2026.06.2-or-later
Who cares nocodb, oauth, self-hosted
2026.06.22026.06.2 or laterNocoDB before 2026.06.2 contains a race condition vulnerability in oauth-token.service.ts that allows attackers to reuse a refresh token by presenting it concurrently during non-atomic rotation. Attackers holding a captured refresh token can race the legitimate client to obtain their own access and refresh tokens, retaining scoped access without triggering reuse detection.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.