Information Disclosure in NocoDB Affects TLS Client Private Keys

CVE-2026-126271

What is CVE-2026-126271?

NocoDB versions prior to 2026.09.0 are susceptible to an information disclosure vulnerability where authenticated base Viewers can access TLS client private keys via the reading of a base's data source. The reading mechanism inadequately masks critical sensitive data, such as the connection password, allowing attackers to retrieve the decrypted private key, client certificate, and Certificate Authority (CA). This weakness enables unauthorized direct connections to external databases, circumventing the intended permissions set within NocoDB.

References