CVE-2026-28361: NocoDB MCP Token Operations Lacks Ownership Validation
Summary
CVE-2026-28361: NocoDB Missing Ownership Validation in MCP Token Operations. Affects nocodb versions < 0.301.3. Fixed in 0.301.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NocoDB is an open-source platform that transforms databases into smart APIs, enabling users to build applications without extensive coding. It provides features such as data management, API generation, and collaboration tools. However, a recent vulnerability has been identified in its MCP token service, which could allow unauthorized access to token operations.
Vulnerability Detail
The MCP token service in NocoDB does not validate token ownership, which means that a user with the Creator role can access, regenerate, or delete another user's MCP tokens if they know the token ID. This oversight occurs in the methods McpTokenService.get(), regenerateToken(), and delete(), which fail to enforce ownership checks. The lack of proper filtering by fk_user_id poses a risk of denial of service through token invalidation and potential exposure of scoped tokens.
How To Fix
Latest published version: 0.301.3 as of 22 Oct 2026
npm install nocodb@0.301.3The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the MCP token operations by implementing additional application-level checks to ensure that users can only access their own tokens until the package is updated.
Conclusion
The vulnerability identified as CVE-2026-28361 in NocoDB poses a risk due to the lack of ownership validation in MCP token operations. Users are advised to update to the latest version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for nocodb →
FAQ
The vulnerability allows users with the Creator role to manipulate other users' MCP tokens without proper ownership validation.
The primary risks include denial of service through token invalidation and unauthorized access to scoped tokens.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 4.9, indicating a moderate level of severity.
Vulert provides real-time monitoring and alerts for open-source vulnerabilities using just your package-lock.json file, making it easy to stay informed.
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
