CVE-2026-126292: NocoDB before 2026.06.1 Password Hash Exposure via Profile Update Response
NocoDB before 2026.06.1 contains an information disclosure vulnerability in the profile update handler in users.service.ts, which returns the stored user record without passing it through the user-serialization filter, exposing the bcrypt password hash, salt, and session token counter. Attackers holding a stolen or hijacked session can update the profile to retrieve that account's password hash and salt for offline cracking.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NocoDBto a version that resolves this vulnerability.Fixed in 2026.06.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid authenticated session for the target account. The advisory specifically identifies stolen or hijacked sessions as the path to abuse.
What information is exposed through the vulnerable response?
Updating a profile can return the account's bcrypt password hash, salt, and session token counter because the stored user record is not passed through the user-serialization filter.
What is the practical impact of the exposed password data?
The bcrypt hash and salt can be used for offline password-cracking attempts. The issue does not state that plaintext passwords are directly disclosed.
Which versions should be remediated?
NocoDB versions before 2026.06.1 are affected. Upgrade to 2026.06.1 or later.