CVE-2026-126288 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
NocoDB before 2026.06.2 exposes full OAuth client records through a public client lookup route in oauth.controller.ts. An attacker who knows or guesses a client identifier can obtain the registration access token, which lets them modify or delete that registration, plus the bcrypt client secret hash and the owner's internal identifier.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
NocoDB deployments before 2026.06.2 that expose the public OAuth client lookup route. Attackers need a client identifier, which they can know or guess, so exposure depends on whether the instance is reachable from outside the team's network. Instances already on 2026.06.2 or later are not affected.
Not affected if version-2026.06.2-or-later
Who cares nocodb, oauth, self-hosted
2026.06.2 or later is not affected by this entry.2026.06.2 or later.NocoDB before 2026.06.2 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve full OAuth client records by querying the public client lookup route in oauth.controller.ts. Attackers who know or guess a client identifier can obtain the registration access token to modify or delete registrations, plus the bcrypt client secret hash and owner's internal identifier.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.