Skip to content
CVE-2026-126280 in NocoDB Allows Refresh Token Reuse

CVE-2026-126280 in NocoDB Allows Refresh Token Reuse

First seen 14 Nov 2026, 02:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 14, 2026 at 02:48 UTC
  • •CVE-2026-126280 has a CVSS score of 9.1, indicating critical severity.
  • •The vulnerability allows token reuse through a race condition in refresh-token rotation.
  • •Immediate upgrade to NocoDB version 2026.08.0 or later is recommended to mitigate risks.

NocoDB versions prior to 2026.08.0 contain a vulnerability (CVE-2026-126280) that allows attackers to exploit a race condition in refresh-token rotation. This flaw enables the reuse of captured refresh tokens, allowing unauthorized access to user sessions without detection. The vulnerability affects self-hosted, internet-facing low-code database platforms, particularly those with multiple users or sensitive data. Attackers can exploit this by sending concurrent refresh requests while a legitimate user is refreshing their session. The CVSS score for this vulnerability is 9.1, classified as. The vendor released a fix on November 13, 2026, but the urgency of the situation is unclear due to a lack of exploitation data. Organizations are advised to upgrade immediately and monitor for unusual session activity.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 14h ago How this analysis works

Timeline

2026-11-13
CVE-2026-126280 published
NocoDB disclosed a critical vulnerability affecting versions before 2026.08.0, allowing refresh token reuse.
Redpacketsecurity
2026-11-13
Patch released
Vendor released a fixed version of NocoDB to address the critical vulnerability.
Redpacketsecurity

More articles in this cluster (3)

Following this threat?

Track CVE-2026-126280 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (2)

1 / 3

Common questions

Which versions of NocoDB are affected?
NocoDB versions prior to 2026.08.0 are affected by this vulnerability.
What is the CVSS score for this vulnerability?
The CVSS score for CVE-2026-126280 is 9.1, indicating critical severity.
What actions should organizations take?
Organizations should upgrade to NocoDB version 2026.08.0 or later and monitor for unusual session activity.