CVE-2026-126271

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.09.0

Description An information disclosure issue exists where authenticated users with base Viewer permissions can obtain TLS client private keys by reading a base's data source. The source read handler only masks the connection password, which allows attackers to retrieve the decrypted private key, client certificate, and CA. This enables direct connection to the external database, bypassing established permissions.

Recommendations Update NocoDB to version 2026.09.0 or later.