CVE-2026-28360: NocoDB has Plaintext Storage of Shared View Passwords

CVE-2026-28360 · Severity: medium · CVSS 4 · Published 2026-03-02

NocoDB is a popular open-source database management platform that allows users to share database views with passwords for access control. This vulnerability stores those view passwords in plaintext in the database instead of hashing them; if an attacker gains database access through a separate breach or misconfiguration, the shared view passwords become immediately visible and can be reused to access sensitive data views.

Technologies: nocodb (npm). Vendors: npm.

Quick answers

Is CVE-2026-28360 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-28360 being exploited in the wild.
How severe is CVE-2026-28360?
Medium severity, with a CVSS score of 4, published 2 March 2026.
Which products and versions are affected?
nocodb (npm) <= 0.301.2, SEMVER:introduced=0,fixed=0.301.3.
Is there a fix for CVE-2026-28360?
Yes. nocodb (npm): upgrade to 0.301.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28360 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-28360?
Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nocodb (npm): upgrade to 0.301.3 or later
    npm install nocodb@0.301.3

Technical details

The vulnerability is a plaintext password storage issue (CWE-256) in the nc_views database table where shared view passwords are stored unhashed. Verification of passwords uses direct string equality comparison (=== operator) across public-datas.service.ts, public-metas.service.ts, and calendar-datas.service.ts rather than cryptographic comparison. The attack requires prior compromise of the NocoDB database itself or its underlying storage. Once database access is obtained, shared view passwords are immediately readable without additional effort. The vulnerability is fixed in version 0.301.3; all versions up to 0.301.2 are affected.

Affected products

  • NocoDB NocoDB 0 to 0.301.2

Identifiers

  • CVE-2026-28360
  • GHSA-mpp2-x7wv-38hv

Timeline

  • 2026-03-02: disclosed: Advisory published
  • 2026-03-02: patched: Fixed in version 0.301.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.