CVE-2026-126290

CVSS 7.1 (high) · published 2026-11-13

NocoDB before 2026.07.0 contains an information disclosure vulnerability in base-integrations.service.ts that allows authenticated base members to read private integration configurations by omitting a query flag. Attackers can request another user's private integration without the configuration flag, bypassing the ownership check to obtain stored connection credentials.

Weakness: CWE-200

Source: NVD CVE-2026-126290

References

• https://github.com/nocodb/nocodb/security/advisories/GHSA-wxxj-mghf-33v4
• https://www.vulncheck.com/advisories/nocodb-before-2026.07.0-private-integration-credential-exposure-via-base-integration-read

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.