Quick answers
- Is CVE-2026-28361 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-28361 being exploited in the wild.
- How severe is CVE-2026-28361?
- Medium severity, with a CVSS score of 4, published 2 March 2026.
- Which products and versions are affected?
- nocodb (npm) <= 0.301.2, SEMVER:introduced=0,fixed=0.301.3.
- Is there a fix for CVE-2026-28361?
- Yes. nocodb (npm): upgrade to 0.301.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-28361 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-28361?
- Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- nocodb (npm): upgrade to 0.301.3 or later
npm install nocodb@0.301.3
Technical details
The McpTokenService.get(), regenerateToken(), and delete() functions did not filter operations by the fk_user_id field, failing to enforce ownership validation. This authorization bypass (CWE-639) allows a Creator-role user to manipulate MCP tokens belonging to other users if the token ID is known, whereas the analogous ApiTokensService correctly enforced ownership checks. Attack requires network access to NocoDB, Creator role within a shared base, and knowledge of the target token ID. An attacker can achieve token disclosure (reading scoped credentials) or denial of service (invalidating tokens). The vulnerability was patched in version 0.301.3.
Affected products
- NocoDB NocoDB <= 0.301.2
Identifiers
- CVE-2026-28361
- GHSA-p9x3-w98f-7j3q
Timeline
- 2026-03-02: disclosed
- 2026-03-02: patched: version 0.301.3 released