Who is not affected by CVE-2026-28360?

Q: Who is not affected by CVE-2026-28360?

Not affected if: managed-hosting, no-password-on-shared-views.

MEDIUM5.3CVSS · security-advisories@github.com

NO KNOWN
EXPLOIT

NOCODB · CVE-2026-28360 · Package

NocoDB has Plaintext Storage of Shared View Passwords

FIX → 0.301.3

NocoDB stored passwords for shared views unhashed in the nc_views table and compared them with direct string equality. Anyone who can read the database can read those passwords and reuse them where the same password was used elsewhere.

first public Mar 2, 2026 · 2 sources

Check it with your coding agent

It checks your repository and tells you if you’re affected, with the fix.

01 · Who is affected

Teams that self-host NocoDB and protect shared views with a password. The exposure requires access to the database, so instances on managed hosting where the database is not reachable carry less risk. The sources say the main risk is password reuse.

nocodb<= 0.301.2fixed in 0.301.3
nocodb< 0.301.3fixed in 0.301.3

Not affected if managed-hosting, no-password-on-shared-views

Who cares cwe-256, nocodb, npm, self-hosted

02 · How to check

Check the installed NocoDB version, for example npm ls nocodb in the deployment directory, and compare it with the affected range.
Look for shared views protected by a password in your NocoDB instance; those passwords are the ones stored in plaintext.

03 · The fix

Upgrade to 0.301.3

nocodb upgrade to 0.301.3 or later (npm package, affected up to ).

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: 0.2% in 30 days
Last updated: Nov 5, 2026

How it unfolded

3 events · Mar 2, 2026 → Nov 5, 2026

What the sources say, verbatim

548 characters

Summary

Shared view passwords were stored in plaintext in the database and compared using direct string equality.

Details

The password column in nc_views stored unhashed passwords. Verification used !== comparison across public-datas.service.ts, public-metas.service.ts, and calendar-datas.service.ts.

Impact

If the database is compromised, shared view passwords are immediately readable. Risk is limited to password reuse scenarios.

Credit

This issue was reported by @Tulgaaaaaaaa.

Sources and references

GitHub Advisories: GHSA-mpp2-x7wv-38hv

Are you affected?

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

Get the next Nocodb threat the day it hits your stack.

Start watching free

Post Share

MEDIUM5.3CVSS · security-advisories@github.com

NO KNOWN
EXPLOIT

NOCODB · CVE-2026-28360 · Package

NocoDB has Plaintext Storage of Shared View Passwords

FIX → 0.301.3

first public Mar 2, 2026 · 2 sources

Check it with your coding agent

It checks your repository and tells you if you’re affected, with the fix.

01 · Who is affected

nocodb<= 0.301.2fixed in 0.301.3
nocodb< 0.301.3fixed in 0.301.3

Not affected if managed-hosting, no-password-on-shared-views

Who cares cwe-256, nocodb, npm, self-hosted

02 · How to check

Check the installed NocoDB version, for example npm ls nocodb in the deployment directory, and compare it with the affected range.
Look for shared views protected by a password in your NocoDB instance; those passwords are the ones stored in plaintext.

03 · The fix

Upgrade to 0.301.3

nocodb upgrade to 0.301.3 or later (npm package, affected up to ).

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: 0.2% in 30 days
Last updated: Nov 5, 2026

How it unfolded

3 events · Mar 2, 2026 → Nov 5, 2026

What the sources say, verbatim

548 characters

Summary

Shared view passwords were stored in plaintext in the database and compared using direct string equality.

Details

The password column in nc_views stored unhashed passwords. Verification used !== comparison across public-datas.service.ts, public-metas.service.ts, and calendar-datas.service.ts.

Impact

If the database is compromised, shared view passwords are immediately readable. Risk is limited to password reuse scenarios.

Credit

This issue was reported by @Tulgaaaaaaaa.

Sources and references

GitHub Advisories: GHSA-mpp2-x7wv-38hv

Are you affected?

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

Get the next Nocodb threat the day it hits your stack.

Start watching free

NocoDB has Plaintext Storage of Shared View Passwords

01 · Who is affected

02 · How to check

03 · The fix

How it unfolded

What the sources say, verbatim

Summary

Details

Impact

Credit

Sources and references

Read next

Get the next Nocodb threat the day it hits your stack.

NocoDB has Plaintext Storage of Shared View Passwords

01 · Who is affected

02 · How to check

03 · The fix

How it unfolded

What the sources say, verbatim

Summary

Details

Impact

Credit

Sources and references

Read next

Get the next Nocodb threat the day it hits your stack.