Executive brief
NocoDB, a platform that turns databases into smart spreadsheets, contained a flaw in how it verified passwords for shared views. For older accounts using legacy passwords, the system compared passwords in a way that allowed an attacker to guess the password by measuring how long the server took to respond. If exploited, an unauthorized person could gain access to private data shared via these spreadsheet views.
Technical details
A timing side-channel vulnerability exists in NocoDB's shared-view authentication mechanism. For legacy plaintext passwords (those not migrated to bcrypt), the application utilized strict-equality (===) comparison in View.ts and the EE dashboard model's verifyPassword function. Because strict equality returns early upon finding a mismatched character, an attacker can measure response times to determine the password's length and discover it character-by-character. The vulnerability is resolved in version 2026.05.1 by implementing crypto.timingSafeEqual and ensuring constant-time comparisons even during length mismatches.
Affected products
- nocodb nocodb < 2026.05.1
Timeline
- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD