CVE-2026-126271
HIGH
NVD
CVSS Score
7.7
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
NocoDB before 2026.09.0 contains an information disclosure vulnerability that allows authenticated base Viewers to obtain TLS client private keys by reading a base's data source. The source read handler masked only the connection password, letting attackers retrieve the decrypted private key, client certificate and CA to connect directly to the external database, bypassing NocoDB permissions.