CVE-2026-126292 · Package
NO FIX YET · SEE WHAT TO DO
NocoDB's profile update handler returns the stored user record without filtering it, so the bcrypt password hash, salt and session token counter come back in the response. An attacker holding a stolen or hijacked session can read these values and attempt offline password cracking.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running a self-hosted or cloud NocoDB instance on a version before 2026.06.1 are exposed, because any logged-in user's profile update response includes their own password hash and salt. An attacker needs an already stolen or hijacked session, so instances without shared or exposed sessions carry less practical risk. unknown for other deployment details.
Not affected if version-2026.06.1-or-later
Who cares nocodb, self-hosted
2026.06.1 are affected.2026.06.1 or later.NocoDB before 2026.06.1 contains an information disclosure vulnerability in the profile update handler in users.service.ts, which returns the stored user record without passing it through the user-serialization filter, exposing the bcrypt password hash, salt, and session token counter. Attackers holding a stolen or hijacked session can update the profile to retrieve that account's password hash and salt for offline cracking.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.