Information Disclosure in NocoDB Before 2026.09.0

Executive Summary

CVE-2026-126271 is an information disclosure vulnerability in NocoDB versions before 2026.09.0. It allows authenticated base Viewers with read-only access to retrieve TLS client private keys, client certificates, and CA certificates from external databases configured with TLS client-certificate authentication. The vulnerability occurs because the data source read handler returns fully decrypted connection configurations while only masking the password.

Useful 0 Not Useful 0

Detection Guidance

Check NocoDB versions prior to 2026.09.0 for exposed TLS credentials in data source configurations. Inspect API responses for data source reads to see if TLS client private keys, certificates, or CA certificates are returned in plaintext. Review logs for unauthorized external database connections originating from NocoDB instances.

Useful 0 Not Useful 0

Impact Analysis

An attacker with base Viewer access can use the exposed TLS credentials to connect directly to the external database, bypassing NocoDB's row, column, and view permissions. This grants unauthorized access to sensitive data stored in the database, potentially leading to data theft or further attacks on the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access controls, such as GDPR's principles of data confidentiality and integrity, and HIPAA's safeguards for protected health information. Unauthorized access to sensitive data could result in regulatory penalties and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NocoDB to version 2026.09.0 or later to patch the vulnerability. Rotate all exposed TLS client private keys, client certificates, and CA certificates for external databases. Restrict base Viewer permissions to prevent unauthorized data source access. Monitor network traffic for suspicious connections to external databases.

Useful 0 Not Useful 0