CVE-2026-126288: NocoDB before 2026.06.2 Credential Disclosure via Public OAuth Client Endpoint
NocoDB before 2026.06.2 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve full OAuth client records by querying the public client lookup route in oauth.controller.ts. Attackers who know or guess a client identifier can obtain the registration access token to modify or delete registrations, plus the bcrypt client secret hash and owner's internal identifier.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
No authentication or user interaction is required. The attacker needs to know or successfully guess an OAuth client identifier and query the public client lookup route.
What information can be exposed?
The vulnerable route can return full OAuth client records, including the registration access token, the bcrypt client secret hash, and the owner's internal identifier. The registration access token can be used to modify or delete registrations.
Which deployments are affected?
NocoDB versions before 2026.06.2 are affected. Exposure depends on the public OAuth client lookup route being reachable and on attackers being able to obtain or guess client identifiers.
How can I determine whether my instance is vulnerable?
Check the deployed NocoDB version. Instances running a version earlier than 2026.06.2 should be treated as affected.