NocoDB OAuth Client Information Disclosure Vulnerability

Executive Summary

NocoDB before version 2026.06.2 has an information disclosure vulnerability where unauthenticated attackers can retrieve full OAuth client records by querying a public endpoint. This allows access to sensitive data like registration access tokens, bcrypt-hashed client secrets, and internal identifiers if an attacker knows or guesses a client identifier.

Useful 0 Not Useful 0

Detection Guidance

Check if your NocoDB instance is running a version before 2026.06.2 by running: curl -s http://your-nocodb-instance.com/package.json | grep version. If the version is below 2026.06.2, the system is vulnerable.

Test for the vulnerability by querying the public OAuth client endpoint: curl -s http://your-nocodb-instance.com/api/v1/oauth/clients/{client_id}. If it returns sensitive data like client secrets or tokens, the system is affected.

Useful 0 Not Useful 0

Impact Analysis

Attackers could use the exposed OAuth client secrets to modify or delete registrations, potentially gaining unauthorized access to the system. The bcrypt-hashed secrets could also be cracked offline to further compromise security.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of OAuth credentials may also breach data protection and access control policies mandated by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NocoDB to version 2026.06.2 or later immediately to patch the vulnerability. This is the primary and most effective mitigation step.

If immediate upgrade is not possible, restrict access to the OAuth client endpoint by implementing network-level controls or firewall rules to block unauthorized access.

Useful 0 Not Useful 0