Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-28361 is a vulnerability in the npm package nocodb, specifically in the MCP token service before version 0.301.3.'}, {'type': 'paragraph', 'content': 'The issue occurs because the MCP token service methods (get(), regenerateToken(), and delete()) do not validate token ownership by failing to filter tokens based on the user ID.'}, {'type': 'paragraph', 'content': "This means that a user with the Creator role within the same database base can read, regenerate, or delete another user's MCP tokens if they know the token ID."}, {'type': 'paragraph', 'content': "This is an authorization bypass vulnerability classified under CWE-639, where authorization mechanisms fail to prevent access to another user's data by manipulating key identifiers."}, {'type': 'paragraph', 'content': 'The vulnerability was fixed in version 0.301.3 of nocodb.'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a user with the Creator role to access, regenerate, or delete MCP tokens belonging to other users if they know the token ID.

The primary impacts include unauthorized disclosure of scoped tokens and potential denial of service by invalidating tokens.

However, the impact is somewhat limited because the attacker must have the Creator role and know the token ID.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': "This vulnerability involves the MCP token service in NocoDB versions prior to 0.301.3, where token ownership is not validated, allowing a Creator role user to access or manipulate other users' tokens if the token ID is known."}, {'type': 'paragraph', 'content': 'Detection would require monitoring or auditing MCP token operations such as get(), regenerateToken(), and delete() calls to see if tokens belonging to other users are being accessed or manipulated.'}, {'type': 'paragraph', 'content': 'However, no specific commands or network detection methods are provided in the available resources.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade NocoDB to version 0.301.3 or later, where the vulnerability has been patched.

Since the vulnerability requires a user with Creator role and knowledge of token IDs, restricting Creator role assignments and protecting token IDs can also reduce risk.

Useful 0 Not Useful 0