CVE-2026-46550: NocoDB Refresh Token Cookie Vulnerability Exposes Users to CSRF and Interception Risks
Summary
CVE-2026-46550: NocoDB: Refresh Token Cookie Set Without secure and sameSite Flags. Affects nocodb versions < 0.301.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NocoDB is an open-source platform that transforms databases into a smart spreadsheet interface, allowing users to manage and interact with their data easily. It supports various databases and provides features like user authentication, API access, and real-time collaboration. However, a vulnerability was discovered in its refresh token management, which could lead to serious security risks if not addressed.
Vulnerability Detail
The vulnerability arises from the refresh-token cookie being set without the 'secure' flag and 'sameSite' attribute. This oversight allows the cookie to be intercepted over plain HTTP connections, exposing it to potential attackers. Additionally, the absence of the 'sameSite' attribute permits browsers to send the cookie with cross-site requests, enabling Cross-Site Request Forgery (CSRF) attacks against the token-refresh endpoint. The refresh endpoint reads the cookie unconditionally and returns a new JWT without CSRF protection, leading to a significant security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider implementing a temporary workaround by ensuring that your application is only accessible over HTTPS. This will help mitigate the risk of cookie interception. Additionally, you can implement CSRF tokens in your requests to the token-refresh endpoint to add an extra layer of security.
Conclusion
The NocoDB refresh token vulnerability (CVE-2026-46550) poses significant risks due to improper cookie handling, which can lead to CSRF attacks and cookie interception. It is crucial for users to update to the latest version of NocoDB and implement recommended security practices to safeguard their applications.
See every vulnerability recorded for nocodb →
FAQ
The vulnerability involves the refresh-token cookie being set without the 'secure' flag and 'sameSite' attribute, making it susceptible to interception and CSRF attacks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
The impacts include cookie interception over plain HTTP networks and the possibility of malicious cross-origin pages triggering token refresh, leading to unauthorized access.
Yes, a patch is available in version 0.301.4 and later of the NocoDB package. It is recommended to update to this version to mitigate the vulnerability.
The CVSS score of this vulnerability is 5.4, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
