CVE-2026-46550: NocoDB CSRF Vulnerability

CVE-2026-46550 Overview

CVE-2026-46550 affects NocoDB, an open-source platform that turns relational databases into spreadsheet-style interfaces. The vulnerability stems from an insecure cookie configuration on the refresh-token cookie. NocoDB versions prior to 2026.04.1 set the cookie with httpOnly: true but omitted both the secure flag and the sameSite attribute. Attackers on the same network can intercept the cookie over plain HTTP. The missing sameSite attribute also lets browsers attach the cookie to cross-site POST requests, enabling Cross-Site Request Forgery (CSRF) against the token-refresh endpoint. The issue is tracked under [CWE-614] (Sensitive Cookie Without Secure Attribute) and is fixed in version 2026.04.1.

Critical Impact
An attacker who induces a victim to visit a malicious page, or who observes plaintext HTTP traffic, can hijack the NocoDB session refresh flow and obtain authenticated access to the victim's account.

Affected Products

NocoDB versions prior to 2026.04.1
Deployments served over plain HTTP
Multi-user NocoDB instances accessible from untrusted networks

Discovery Timeline

2026-06-23 - CVE-2026-46550 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-46550

Vulnerability Analysis

NocoDB issues a refresh-token cookie to maintain authenticated sessions. The cookie is set with httpOnly: true, which blocks JavaScript access, but the implementation omits two additional protections that browsers rely on to scope cookie transmission.

The first omission is the secure flag. Without it, the browser transmits the cookie over unencrypted HTTP connections. An attacker positioned on the same Wi-Fi network or anywhere along the request path can read the token in cleartext and replay it.

The second omission is the sameSite attribute. Modern browsers default to Lax in many cases, but explicit configuration is required for predictable behavior. With no attribute set, older browsers and certain request flows attach the cookie to cross-origin POST requests, exposing the token-refresh endpoint to CSRF.

Root Cause

The root cause is an incomplete cookie security policy in the NocoDB session handler. The developers protected against XSS-based theft via httpOnly but did not enforce transport-layer confinement (secure) or origin confinement (sameSite). [CWE-614] describes this exact pattern of sensitive cookies missing the secure attribute.

Attack Vector

Two attack paths exist. In the network interception path, an attacker on a shared network captures HTTP traffic and extracts the refresh-token cookie value. The attacker then submits the token to the NocoDB refresh endpoint to receive a valid access token.

In the CSRF path, the attacker hosts a malicious page that issues a cross-origin POST to the NocoDB token-refresh URL. The victim's browser attaches the refresh-token cookie automatically. The endpoint accepts the request and may rotate or extend the session under attacker-controlled conditions, or the attacker can pair this with response-leaking techniques to obtain the new token. User interaction is required, consistent with the UI:R component of the CVSS vector.

No verified exploit code is publicly available. Refer to the GitHub Security Advisory GHSA-f74w-272x-mqcv for the maintainer's technical write-up.

Detection Methods for CVE-2026-46550

Indicators of Compromise

Unexpected POST requests to the NocoDB /auth/token/refresh endpoint originating from external Referer or Origin headers.
Successful token-refresh events followed by API calls from IP addresses that do not match the user's recent activity.
Multiple refresh-token reuses from geographically inconsistent source addresses within a short window.

Detection Strategies

Inspect HTTP response headers from NocoDB and flag Set-Cookie: refresh-token entries missing Secure or SameSite directives.
Correlate web server access logs for refresh-endpoint hits whose Origin does not match the configured NocoDB hostname.
Alert on session refreshes that occur outside expected user agents or that arrive without a corresponding prior authentication event.

Monitoring Recommendations

Enable verbose logging on the NocoDB authentication routes and ship logs to a centralized analytics platform.
Monitor reverse-proxy or WAF telemetry for cross-origin POSTs targeting authentication paths.
Track the version string returned by NocoDB health endpoints to confirm all instances run 2026.04.1 or later.

How to Mitigate CVE-2026-46550

Immediate Actions Required

Upgrade NocoDB to version 2026.04.1 or later on every instance.
Force HTTPS for all NocoDB traffic by terminating TLS at a reverse proxy and redirecting HTTP to HTTPS.
Invalidate existing refresh tokens after upgrade to revoke any sessions that may have been captured.

Patch Information

The maintainers fixed the issue in NocoDB 2026.04.1 by setting the secure flag and an appropriate sameSite attribute on the refresh-token cookie. Review the GitHub Security Advisory GHSA-f74w-272x-mqcv for upgrade instructions and verification steps.

Workarounds

Place NocoDB behind a reverse proxy that rewrites Set-Cookie headers to add Secure and SameSite=Lax or SameSite=Strict.
Restrict NocoDB exposure to trusted networks or a VPN until the upgrade is applied.
Configure the reverse proxy to reject cross-origin POSTs to authentication endpoints by validating the Origin header.

bash

# NGINX reverse-proxy snippet to enforce cookie hardening
proxy_cookie_flags refresh-token secure samesite=lax;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;

# Redirect HTTP to HTTPS
server {
    listen 80;
    server_name nocodb.example.com;
    return 301 https://$host$request_uri;
}