# CVE-2026-29198: Rocket.Chat NoSQL injection in OAuth token handling

Source: https://junglewise.ai/threats/cve-2026-29198-rocket-chat-nosql-injection-in-oauth-token-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-23. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-29198 · Severity: critical · CVSS 9.8 · Published 2026-04-23

Rocket.Chat, a popular open-source communications platform, is affected by a critical security flaw in how it handles authentication for third-party applications. An attacker can exploit this to take over the account of the first user who has a generated security token. This could lead to unauthorized access to sensitive corporate communications and full administrative control over the chat environment.

Technologies: [Rocket.Chat](https://junglewise.ai/threats/technologies/rocket-chat). Vendors: [Rocket.Chat](https://junglewise.ai/threats/vendors/rocket-chat).

## Quick answers

**Is CVE-2026-29198 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-29198 being exploited in the wild.

**How severe is CVE-2026-29198?** Critical severity, with a CVSS score of 9.8, published 23 April 2026.

**Which products and versions are affected?** Rocket.Chat < 8.3.0, < 8.2.1, < 8.1.2, < 8.0.3, < 7.13.5, < 7.12.6, < 7.11.6, < 7.10.9.

**Is there a fix for CVE-2026-29198?** A patch was published on 2026-03-10: Fix merged into Rocket.Chat develop branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-29198 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-29198?** Check whether you run Rocket.Chat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A NoSQL injection vulnerability exists in Rocket.Chat's handling of OAuth2 authentication tokens. When an OAuth application is configured, the system fails to properly sanitize or validate token-related queries, allowing an attacker to inject NoSQL commands. This flaw can be exploited to identify and hijack the session or account of the first user associated with a generated token. The vulnerability is reachable over the network without prior authentication. Patches have been released across multiple major versions (7.x and 8.x) to address the improper neutralization of special elements in database queries.

## Affected products

- Rocket.Chat Rocket.Chat < 8.3.0, < 8.2.1, < 8.1.2, < 8.0.3, < 7.13.5, < 7.12.6, < 7.11.6, < 7.10.9

## Timeline

- 2026-03-10: patched: Fix merged into Rocket.Chat develop branch
- 2026-04-23: disclosed: Initial disclosure via HackerOne/NVD

## References

- [https://github.com/RocketChat/Rocket.Chat/pull/39492](https://github.com/RocketChat/Rocket.Chat/pull/39492)
- [https://hackerone.com/reports/3564655](https://hackerone.com/reports/3564655)

## Related threats

- [Rocket.Chat sendForgotPasswordEmail method missing DDP rate limit](https://junglewise.ai/threats/cve-2026-75575-rocket-chat-sendforgotpasswordemail-method-missing-ddp-rate-limit)
- [Rocket.Chat Meteor DDP method authorization bypass](https://junglewise.ai/threats/cve-2026-65645-rocket-chat-meteor-ddp-method-authorization-bypass)
- [Rocket.Chat Omnichannel queue stored XSS via visitor name](https://junglewise.ai/threats/cve-2026-65644-rocket-chat-omnichannel-queue-stored-xss-via-visitor-name)
- [Rocket.Chat authentication bypass in SAML SSO](https://junglewise.ai/threats/cve-2026-58066-rocket-chat-authentication-bypass-in-saml-sso)
- [Rocket.Chat missing authorization in fingerprint REST endpoint](https://junglewise.ai/threats/cve-2026-55762-rocket-chat-missing-authorization-in-fingerprint-rest-endpoint)