CVE-2026-28360: NocoDB Plaintext Storage of Shared View Passwords Vulnerability
Summary
CVE-2026-28360: NocoDB has Plaintext Storage of Shared View Passwords. Affects nocodb versions < 0.301.3. Fixed in 0.301.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
NocoDB is an open-source platform that transforms databases into smart spreadsheets, enabling users to manage data easily. It supports various databases and offers features like collaboration, sharing, and data visualization. However, a critical vulnerability has been identified where shared view passwords are stored in plaintext, posing a significant security risk.
Vulnerability Detail
The vulnerability arises from the storage of shared view passwords in plaintext within the database, specifically in the 'password' column of the 'nc_views' table. This design flaw allows for direct string comparison using '!==', which means that if an attacker gains access to the database, they can easily read these passwords. The primary risk is associated with password reuse, where users might use the same password across multiple platforms, increasing the potential for unauthorized access.
How To Fix
Latest published version: 0.301.3 as of 22 Oct 2026
npm install nocodb@0.301.3The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional access controls to the database to limit exposure. Additionally, avoid using the same passwords across different platforms to mitigate risks associated with password reuse.
Conclusion
The NocoDB vulnerability (CVE-2026-28360) highlights a significant security flaw due to the plaintext storage of shared view passwords. Users are strongly advised to update to the latest version to mitigate risks. Implementing additional security measures can also help protect sensitive information.
See every vulnerability recorded for nocodb →
FAQ
The vulnerability involves the storage of shared view passwords in plaintext, making them easily accessible if the database is compromised.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 2.7, indicating a low severity level.
If you cannot update, implement strict access controls to your database and avoid password reuse to minimize risks.
This issue was reported by a user on GitHub with the username @Tulgaaaaaaaa.
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
