External risk intelligence

NocoDB Stored XSS via Attachment MIME Type Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-126269

NocoDB is a web-based database management platform commonly deployed as a web application accessible via network interfaces. While this specific vulnerability requires authenticated access, the application itself is typically deployed as a web-facing service, making its interfaces reachable from the internet or internal networks where such services are commonly exposed.

Cross-site Scripting

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a stored cross-site scripting vulnerability in NocoDB, a web-based database management platform, that could allow authenticated users to execute scripts and potentially steal session tokens.

Stored scripts can steal user sessions.
Critical risk to authenticated user sessions.
Confirm relevance and review for exposure.

Attack Path

How an attacker could exploit the issue

An attacker with Editor privileges can exploit this vulnerability by storing malicious crafted attachment MIME types. The application then uses this crafted value when serving a temporary URL, which can be made to render as HTML. This allows the attacker to inject scripts that steal session tokens from a victim's browser, enabling account impersonation.

Requires authenticated Editor access.
Crafted attachment MIME types trigger script execution.
Risk of session token theft and impersonation.

Live Threat

Current exploitation, exposure, and threat context

Authenticated Editor users could execute arbitrary scripts by storing specially crafted attachment MIME types. When the system serves a temporary URL for these attachments, an attacker could exploit this to serve malicious HTML and steal session tokens from a victim's browser.

User session tokens and related data.
Via specially crafted attachment MIME types.
Session hijacking and unauthorized access.

Operational Fix

Recommended remediation, mitigation, and detection steps

NocoDB, as a web-based database management platform, typically falls under the purview of platform or application teams responsible for its deployment and maintenance. The initial focus should be on identifying all instances of NocoDB within the environment, confirming their accessibility and business criticality, and then locating the accountable owners to initiate a risk-based remediation plan.

Platform or application teams own this.
Verify NocoDB instance reachability and criticality.
Plan remediation based on confirmed exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NocoDB?

NocoDB is an open-source, web-based platform that converts any database into a smart spreadsheet interface. It is commonly used by teams to collaborate on database records, manage workflows, and build internal tools without needing deep SQL knowledge. Because it functions as a centralized database management interface, it is often deployed as a network-accessible web application to allow team-wide data access.

How does CVE-2026-126269 function?

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw, categorized as CWE-79. It occurs because the application improperly validates the MIME types of user-uploaded attachments. By submitting a specially crafted MIME type, an attacker can force the system to treat a file as HTML. When other users access that file, the browser executes the malicious script, potentially exposing sensitive session data stored in the browser's local storage.

Can any user trigger this vulnerability?

No. Successful exploitation requires an attacker to already possess an Editor-level account within the NocoDB instance. The flaw is not triggered by simple visitors or guest users who lack authenticated access. Furthermore, the vulnerability is not activated by standard, well-formed file uploads; it specifically requires the intentional input of a manipulated MIME type to force the browser to render the attachment as an active script.

Why should I care if my NocoDB is internal?

Even if your instance is not directly on the public internet, Halo Surface Signal notes that NocoDB is typically reachable across internal networks where many users have access. If a compromised internal account with Editor privileges exists, they could leverage this flaw to target other authenticated users, such as administrators, leading to session hijacking and unauthorized platform control regardless of whether the site is web-facing.

How do I respond to this threat?

Your first step is to locate all active NocoDB installations within your infrastructure to assess their reachability. Once you have identified these instances, determine if they are running a version earlier than 2026.09.0, which is where this issue resides. Coordinate with the teams managing these deployments to plan an update or apply the vendor's provided patches to eliminate the risk of script execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.