CVE-2026-126271: NocoDB before 2026.09.0 TLS Private Key Exposure via Data Source Read
NocoDB before 2026.09.0 contains an information disclosure vulnerability that allows authenticated base Viewers to obtain TLS client private keys by reading a base's data source. The source read handler masked only the connection password, letting attackers retrieve the decrypted private key, client certificate and CA to connect directly to the external database, bypassing NocoDB permissions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the base Viewer role can exploit it. The affected base must have a data source configured with TLS client credentials.
What information can an attacker obtain?
The attacker can retrieve the decrypted TLS client private key, client certificate, and CA from the base's data source configuration. The connection password is masked, but the TLS materials are not.
What can an attacker do with the exposed TLS credentials?
They can use the retrieved TLS materials to connect directly to the external database, bypassing NocoDB permission controls.
Which versions are affected?
NocoDB versions before 2026.09.0 are affected.