Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-126290— NocoDB before 2026.07.0 Private Integration Credential Exposure via Base Integration Read

Quick assessment

Affected

nocodb nocodb

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

NocoDB 在 2026.07.0 版本之前存在一个信息泄露漏洞，位于文件中。该漏洞允许已认证的 base（工作区）成员通过省略特定的查询标志位来读取私有的集成配置。攻击者可以在请求其他用户的私有集成时不带配置标志位，从而绕过所有权检查，获取其中存储的连接凭证。

CVSS 6.5 · Medium EPSS 0.39% · P33 Updated Nov 15, 2026

Possible ATT&CK Techniques 2 AI

T1213 · Data from Information Repositories T1552 · Unsecured Credentials

Affected Version Matrix 2

Vendor	Product	Version Range	Status
nocodb	nocodb	`< 2026.07.0`	affected
		`2026.07.0`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

NocoDB before 2026.07.0 Private Integration Credential Exposure via Base Integration Read

Source: CVE Program / CVE List V5

Vulnerability Description

NocoDB before 2026.07.0 contains an information disclosure vulnerability in base-integrations.service.ts that allows authenticated base members to read private integration configurations by omitting a query flag. Attackers can request another user's private integration without the configuration flag, bypassing the ownership check to obtain stored connection credentials.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

信息暴露

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
nocodb	nocodb	0 ~ 2026.07.0	-

II. Public POCs for CVE-2026-126290

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126290

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-126290 (2)

Private Integration Configuration Exposure via Base Read · Advisory · nocodb/nocodb · GitHub vendor-advisory
NocoDB before 2026.07.0 Private Integration Credential Exposure via Base Integration Read | Advisories | VulnCheck third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-126290

Same Patch Batch · nocodb · 2026-11-13 · 27 CVEs total

CVE-2026-126291	8.8 HIGH	NocoDB before 2026.06.2 SQL Injection via User Email in Base User Query
CVE-2026-126283	8.8 HIGH	NocoDB before 2026.08.0 Incorrect Authorization via Base-Scoped API Tokens
CVE-2026-126274	8.7 HIGH	NocoDB before 2026.08.0 Stored XSS via Table Deletion Dialog
CVE-2026-126269	8.7 HIGH	NocoDB before 2026.09.0 Stored XSS via Attachment MIME Type
CVE-2026-126273	8.1 HIGH	NocoDB before 2026.09.0 Privilege Escalation via Incomplete Admin Bootstrap
CVE-2026-126286	8.1 HIGH	NocoDB before 2026.08.0 Reflected XSS via ncRedirectUrl in PageLeavingWarning.vue
CVE-2026-126282	8.0 HIGH	NocoDB from 2026.04.0 before 2026.08.0 Improper Privilege Management via Organization Role
CVE-2026-126285	7.7 HIGH	NocoDB before 2026.08.0 SQL Injection via Legacy where Query Filter
CVE-2026-126271	7.7 HIGH	NocoDB before 2026.09.0 TLS Private Key Exposure via Data Source Read
CVE-2026-126278	7.5 HIGH	NocoDB before 2026.08.1 Password Reset Token Race Condition
CVE-2026-126277	7.5 HIGH	NocoDB before 2026.08.1 Uncontrolled Resource Consumption via Shared View Bulk API
CVE-2026-126280	7.4 HIGH	NocoDB before 2026.08.0 Refresh Token Reuse via Non-Atomic Rotation
CVE-2026-126275	7.1 HIGH	NocoDB before 2026.09.0 IDOR in Row Comment Operations
CVE-2026-126267	6.5 MEDIUM	NocoDB from 0.300.0 before 2026.04.4 Denial of Service via MetaService Logging
CVE-2026-126272	6.5 MEDIUM	NocoDB before 2026.09.0 Uncontrolled Resource Consumption via Bulk Record Endpoints
CVE-2026-126293	6.5 MEDIUM	NocoDB before 2026.06.2 Attachment Size Limit Bypass via Upload by URL
CVE-2026-126270	6.5 MEDIUM	NocoDB before 2026.09.1 Unauthenticated Information Disclosure via Aggregated Meta Endpoin
CVE-2026-126281	6.5 MEDIUM	NocoDB before 2026.08.0 Private Integration Credential Exposure via Copy
CVE-2026-126279	6.3 MEDIUM	NocoDB before 2026.06.2 Stored XSS via AI Field Prompt Tooltip
CVE-2026-126276	6.3 MEDIUM	NocoDB before 2026.08.1 Client Authentication Bypass via OAuth Token Exchange

Showing top 20 of 27 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: nocodb

Same vendor: nocodb

Same weakness: CWE-200