CVE-2026-126271

CVSS 8.3 (high) · published 2026-11-13

NocoDB before 2026.09.0 contains an information disclosure vulnerability that allows authenticated base Viewers to obtain TLS client private keys by reading a base's data source. The source read handler masked only the connection password, letting attackers retrieve the decrypted private key, client certificate and CA to connect directly to the external database, bypassing NocoDB permissions.

Weakness: CWE-522

Source: NVD CVE-2026-126271

References

• https://github.com/nocodb/nocodb/security/advisories/GHSA-rjc4-j36j-gjjc
• https://www.vulncheck.com/advisories/nocodb-before-2026.09.0-tls-private-key-exposure-via-data-source-read

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.