Is CVE-2026-28358 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28358 being exploited in the wild.

How severe is CVE-2026-28358?

Medium severity, with a CVSS score of 4, published 2 March 2026.

Which products and versions are affected?

nocodb (npm) SEMVER:introduced=0,fixed=0.301.3.

Is there a fix for CVE-2026-28358?

Yes. nocodb (npm): upgrade to 0.301.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-28358 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-28358?

Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28358: NocoDB user enumeration via password reset endpoint

CVE-2026-28358 · Severity: medium · CVSS 4 · Published 2026-03-02

NocoDB is an open-source database management and collaboration tool used as an Airtable alternative. An unauthenticated attacker could determine whether a specific email address is registered in a NocoDB instance by observing response differences from the password reset endpoint. While this does not expose credentials or data directly, it enables targeted account harvesting and social engineering attacks.

Technologies: nocodb (npm). Vendors: npm.

Quick answers

Is CVE-2026-28358 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28358 being exploited in the wild.
How severe is CVE-2026-28358?: Medium severity, with a CVSS score of 4, published 2 March 2026.
Which products and versions are affected?: nocodb (npm) SEMVER:introduced=0,fixed=0.301.3.
Is there a fix for CVE-2026-28358?: Yes. nocodb (npm): upgrade to 0.301.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28358 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-28358?: Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nocodb (npm): upgrade to 0.301.3 or later
```
npm install nocodb@0.301.3
```

Technical details

The vulnerability is an information disclosure flaw (CWE-204: Observable Response Discrepancy) in the POST /api/v2/auth/password/forgot endpoint. The endpoint returned different HTTP responses for registered emails (success message) versus unregistered emails ('Your email has not been registered.'), allowing unauthenticated attackers to enumerate valid email accounts without authentication or preconditions. No user interaction is required. The attack requires only network access to the endpoint and the ability to send HTTP requests. The fix was implemented in version 0.301.3 to return uniform responses for all emails. No evidence of exploitation in the wild has been reported.

Affected products

NocoDB nocodb <= 0.301.2

Identifiers

CVE-2026-28358
GHSA-387m-j3p9-3php

Timeline

2026-03-02: disclosed
2026-02-27: patched: version 0.301.3 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.