CVE-2026-126281

CVSS 7.1 (high) · published 2026-11-13

NocoDB before 2026.08.0 contains a missing authorization vulnerability in the copy-from branch of integration creation in integrations.service.ts that decrypts a source integration's connection credentials without checking its owner or private flag. Authenticated users with the Creator role can supply guessed or enumerated integration ids to copy other users' private database host, username, and password into an integration they own.

Weakness: CWE-862

Source: NVD CVE-2026-126281

References

• https://github.com/nocodb/nocodb/security/advisories/GHSA-355h-p2mj-vwc9
• https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-private-integration-credential-exposure-via-copy

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.