CVE-2026-126273: NocoDB before 2026.09.0 Privilege Escalation via Incomplete Admin Bootstrap
NocoDB before 2026.09.0 contains a privilege escalation vulnerability in initAdminFromEnv.ts that silently skips super-admin bootstrap when the admin password environment variable is empty. Unauthenticated attackers can call the public signup endpoint first on a fresh instance to receive Creator and Super Admin roles, gaining full administrative control.
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated takeover?
Fresh NocoDB instances running versions before 2026.09.0 are exposed when the admin password environment variable is empty, causing the super-admin bootstrap to be skipped.
What does an attacker need to exploit this issue?
An attacker needs network access to the public signup endpoint and must register before an administrator is bootstrapped. No authentication or user interaction is required.
What access does successful exploitation provide?
The first attacker to use the signup endpoint can receive Creator and Super Admin roles, giving them full administrative control.
How can I determine whether an instance may already be compromised?
Check whether the instance was initially deployed with an empty admin password environment variable and whether accounts were created through the public signup endpoint before legitimate administrator setup. Accounts holding Creator or Super Admin roles warrant review.