Insufficiently protected credentials in NocoDB - CVE-2026-126271
Published: November 9, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU162879
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126271
CWE-ID: CWE-522
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker with base Viewer access to obtain TLS client credentials for a base's external database.
The vulnerability exists due to incomplete credential masking in NocoDB's data source read response when the source uses TLS client-certificate authentication. A remote authenticated attacker with base Viewer access can read the source configuration and use the exposed credentials to authenticate directly to databases accepting client certificates, bypassing NocoDB permissions.
Affected software
NocoDB
How to mitigate CVE-2026-126271
Install security update from vendor's website.
NocoDB - update to 2026.09.0