Quick answers
- Is CVE-2026-28396 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-28396 being exploited in the wild.
- How severe is CVE-2026-28396?
- Medium severity, with a CVSS score of 4, published 2 March 2026.
- Which products and versions are affected?
- nocodb (npm) <= 0.301.2, SEMVER:introduced=0,fixed=0.301.3.
- Is there a fix for CVE-2026-28396?
- Yes. nocodb (npm): upgrade to 0.301.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-28396 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-28396?
- Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- nocodb (npm): upgrade to 0.301.3 or later
npm install nocodb@0.301.3
Technical details
The vulnerability is a session expiration weakness (CWE-613) in NocoDB's password reset flow. The passwordReset() function in users.service.ts increments the token_version field (which invalidates JWTs), but fails to call UserRefreshToken.deleteAllUserToken() to revoke refresh tokens. The refreshToken() method only validates token existence, not token_version compatibility. In contrast, passwordChange() and signOut() correctly delete all refresh tokens. An attacker with a previously stolen refresh token can exploit this to mint new valid JWTs after the victim resets their password, maintaining unauthorized access until the stolen refresh token's natural expiration. The patch is available in version 0.301.3.
Affected products
- NocoDB NocoDB <= 0.301.2
Identifiers
- CVE-2026-28396
- GHSA-x4vh-j75g-268g
Timeline
- 2026-03-02: disclosed: Advisory published
- 2026-03-02: patched: Fix released in version 0.301.3