CVE-2026-47380 Overview
CVE-2026-47380 is a timing side-channel vulnerability in NocoDB, an open-source platform for building databases as spreadsheets. Versions prior to 2026.04.1 return different response times for known and unknown email addresses during sign-in. The unknown-user code path returns immediately without performing the password hash comparison, while the known-user path executes the bcrypt-style verification. Attackers can measure these timing differences to enumerate valid accounts. The issue is tracked as CWE-208: Observable Timing Discrepancy and is fixed in NocoDB 2026.04.1.
Critical Impact
Unauthenticated remote attackers can enumerate valid NocoDB user accounts by analyzing sign-in response timing, exposing email addresses for follow-on credential attacks.
Affected Products
- NocoDB versions prior to 2026.04.1
- Self-hosted NocoDB deployments exposing the sign-in endpoint
- Containerized NocoDB instances running pre-2026.04.1 images
Discovery Timeline
- 2026-06-23 - CVE-2026-47380 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-47380
Vulnerability Analysis
The vulnerability resides in the NocoDB authentication handler. When the application receives a sign-in request, it first queries the user store for a record matching the supplied email address. If no record exists, the handler returns an authentication failure immediately. If a record exists, the handler proceeds to compute and compare the password hash against the stored hash.
Password hash comparison using algorithms such as bcrypt is computationally expensive by design. The difference between the immediate-return path and the hash-comparison path is measurable over the network. Attackers can submit candidate email addresses and record HTTP response latency. Consistently slower responses identify accounts that exist in the system.
This is a confidentiality-only issue. It does not grant authentication bypass or code execution, but it provides reconnaissance data that enables targeted password spraying, phishing, and credential-stuffing campaigns.
Root Cause
The unknown-user branch of the sign-in routine returned without performing a constant-time operation equivalent to the password hash comparison. The codebase did not normalize execution time between the two branches, producing an observable timing discrepancy [CWE-208].
Attack Vector
An unauthenticated attacker sends repeated POST requests to the sign-in endpoint with controlled email values and arbitrary passwords. The attacker measures round-trip time for each request and statistically separates fast responses (unknown email) from slow responses (known email, failed hash compare). No credentials, user interaction, or special privileges are required. The attack is fully remote over the network.
For technical details on the patched code path, see the NocoDB GitHub Security Advisory GHSA-jr54-jwhj-55gp.
Detection Methods for CVE-2026-47380
Indicators of Compromise
- High-volume POST requests to the NocoDB sign-in endpoint from a single source IP or small IP range
- Authentication request bodies cycling through sequential or dictionary-derived email addresses
- Sustained request patterns with low payload variance other than the email field
- Unusual user-agent strings or scripted client signatures hitting /auth/user/signin or equivalent paths
Detection Strategies
- Alert on authentication endpoints when failed sign-in attempts exceed a baseline threshold per source within a short window
- Correlate failed authentications across many distinct email addresses originating from one client
- Inspect web server access logs for repetitive sign-in attempts with varying email parameters
Monitoring Recommendations
- Forward NocoDB application logs and reverse-proxy access logs to a centralized log platform for correlation
- Track per-IP authentication failure rates and email-address cardinality over rolling windows
- Monitor egress from internal hosts to NocoDB instances for signs of internal enumeration
How to Mitigate CVE-2026-47380
Immediate Actions Required
- Upgrade NocoDB to version 2026.04.1 or later on all self-hosted and containerized deployments
- Restrict access to the NocoDB sign-in endpoint to trusted networks or VPN ranges where feasible
- Enforce rate limiting on the authentication endpoint at the reverse proxy or WAF layer
- Audit existing accounts and require password rotation for any users whose email addresses are likely to have been enumerated
Patch Information
The maintainers fixed CVE-2026-47380 in NocoDB 2026.04.1. The patch normalizes execution time between the known-user and unknown-user branches so that the hash comparison operation runs regardless of whether the supplied email exists. Refer to the NocoDB GitHub Security Advisory for upgrade instructions.
Workarounds
- Place NocoDB behind an authenticating reverse proxy or single sign-on gateway to prevent unauthenticated access to the sign-in endpoint
- Apply aggressive per-IP and per-account rate limits at the WAF to reduce timing measurement reliability
- Enable multi-factor authentication for all NocoDB accounts to limit the value of enumerated email addresses
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
