Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-126288— NocoDB before 2026.06.2 Credential Disclosure via Public OAuth Client Endpoint

Quick assessment

Affected
nocodb nocodb
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

NocoDB 在 2026.06.2 版本之前存在一个信息泄露漏洞，允许未经身份验证的攻击者通过查询 中的公共客户端查找路由，获取完整的 OAuth 客户端记录。如果攻击者知道或猜测出某个客户端标识符，就可以获取用于修改或删除注册的访问令牌（access token），以及 bcrypt 哈希后的客户端密钥和所有者的内部标识符。

CVSS 5.3 · Medium EPSS 0.27% · P20

Affected Version Matrix 2

VendorProduct Version RangeStatus
nocodb nocodb < 2026.06.2 affected
2026.06.2 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-126288

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NocoDB before 2026.06.2 Credential Disclosure via Public OAuth Client Endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
NocoDB before 2026.06.2 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve full OAuth client records by querying the public client lookup route in oauth.controller.ts. Attackers who know or guess a client identifier can obtain the registration access token to modify or delete registrations, plus the bcrypt client secret hash and owner's internal identifier.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nocodb nocodb 0 ~ 2026.06.2 -

II. Public POCs for CVE-2026-126288

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-126288

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-126288 (2)

Same Patch Batch · nocodb · 2026-11-13 · 27 CVEs total

CVE-2026-126291 8.8 HIGH NocoDB before 2026.06.2 SQL Injection via User Email in Base User Query
CVE-2026-126283 8.8 HIGH NocoDB before 2026.08.0 Incorrect Authorization via Base-Scoped API Tokens
CVE-2026-126269 8.7 HIGH NocoDB before 2026.09.0 Stored XSS via Attachment MIME Type
CVE-2026-126274 8.7 HIGH NocoDB before 2026.08.0 Stored XSS via Table Deletion Dialog
CVE-2026-126273 8.1 HIGH NocoDB before 2026.09.0 Privilege Escalation via Incomplete Admin Bootstrap
CVE-2026-126286 8.1 HIGH NocoDB before 2026.08.0 Reflected XSS via ncRedirectUrl in PageLeavingWarning.vue
CVE-2026-126282 8.0 HIGH NocoDB from 2026.04.0 before 2026.08.0 Improper Privilege Management via Organization Role
CVE-2026-126285 7.7 HIGH NocoDB before 2026.08.0 SQL Injection via Legacy where Query Filter
CVE-2026-126271 7.7 HIGH NocoDB before 2026.09.0 TLS Private Key Exposure via Data Source Read
CVE-2026-126278 7.5 HIGH NocoDB before 2026.08.1 Password Reset Token Race Condition
CVE-2026-126277 7.5 HIGH NocoDB before 2026.08.1 Uncontrolled Resource Consumption via Shared View Bulk API
CVE-2026-126280 7.4 HIGH NocoDB before 2026.08.0 Refresh Token Reuse via Non-Atomic Rotation
CVE-2026-126275 7.1 HIGH NocoDB before 2026.09.0 IDOR in Row Comment Operations
CVE-2026-126267 6.5 MEDIUM NocoDB from 0.300.0 before 2026.04.4 Denial of Service via MetaService Logging
CVE-2026-126290 6.5 MEDIUM NocoDB before 2026.07.0 Private Integration Credential Exposure via Base Integration Read
CVE-2026-126293 6.5 MEDIUM NocoDB before 2026.06.2 Attachment Size Limit Bypass via Upload by URL
CVE-2026-126270 6.5 MEDIUM NocoDB before 2026.09.1 Unauthenticated Information Disclosure via Aggregated Meta Endpoin
CVE-2026-126281 6.5 MEDIUM NocoDB before 2026.08.0 Private Integration Credential Exposure via Copy
CVE-2026-126272 6.5 MEDIUM NocoDB before 2026.09.0 Uncontrolled Resource Consumption via Bulk Record Endpoints
CVE-2026-126279 6.3 MEDIUM NocoDB before 2026.06.2 Stored XSS via AI Field Prompt Tooltip

Showing top 20 of 27 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: nocodb
Same vendor: nocodb
Same weakness: CWE-200