CVE-2026-116122 NocoDB CVE debrief

Who should care

Defenders responsible for NocoDB systems, especially those using the Sign-in Endpoint, should assess their exposure and prioritize verification of affected versions. This includes operators managing NocoDB deployments, platform administrators, vulnerability management teams, and security teams responsible for monitoring and incident response. They should review the CVE record and NVD vulnerability detail page for information about the security flaw in Noco

Why it matters

CVE-2026-116122 is a medium-severity vulnerability in NocoDB's Sign-in Endpoint that can lead to information disclosure. Defenders should verify affected versions, assess exposure, and prioritize remediation based on their environment's complexity and exploitability.

• Verification of affected NocoDB versions is required to determine exposure.
• Potential remote attacks on the Sign-in Endpoint may lead to information disclosure.
• Defenders should assess the complexity and exploitability of this vulnerability in their environment.
• Remediation priority is moderate due to the medium CVSS score and limited information about exploitation.

Technical summary

The AuthService.validateUser function in NocoDB's Sign-in Endpoint is vulnerable to information disclosure due to improper handling of the 'salt' argument. This vulnerability can be exploited remotely, but the attack's complexity is rated as high and exploitability is considered difficult. Affected product deployments should be verified, and defenders should assess the exposure of their systems, especially those using the Sign-in Endpoint. The vendor's deletion of the GitHub issue without explanation adds to the complexity of remediation planning.

Defensive priority

Defenders should prioritize verifying the affected versions of NocoDB and assessing the exposure of their systems, especially those using the Sign-in Endpoint.

Recommended defensive actions

• Verify the version of NocoDB being used and check if it is within the affected range.
• Assess the exposure of systems using the Sign-in Endpoint.
• Monitor for potential remote attacks on the Sign-in Endpoint.
• Consider implementing compensating controls to mitigate the vulnerability.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD vulnerability detail page provide information about the security flaw in NocoDB. However, the vendor deleted the GitHub issue for this vulnerability without explanation, and there was no response from the vendor when contacted about this disclosure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.