CVE-2026-126290 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
NocoDB before 2026.07.0 has a flaw in its base integrations service that skips an ownership check when a query flag is left out. An attacker with a base membership can read another user's private integration configuration, including stored connection credentials.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host NocoDB before 2026.07.0 and let multiple users share bases with private integrations configured. Exposure needs an account that is a member of the base; the sources do not say whether the flaw applies to every deployment or only some configurations.
Not affected if no-shared-bases, nocodb-2026.07.0-or-later
Who cares nocodb, self-hosted
unknown if the sources give no command.2026.07.0 or later.NocoDB before 2026.07.0 contains an information disclosure vulnerability in base-integrations.service.ts that allows authenticated base members to read private integration configurations by omitting a query flag. Attackers can request another user's private integration without the configuration flag, bypassing the ownership check to obtain stored connection credentials.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.