CVE-2026-47381: NocoDB Auth Bypass Vulnerability

CVE-2026-47381 Overview

CVE-2026-47381 is an authorization bypass vulnerability in NocoDB, an open-source platform for building databases as spreadsheets. The flaw allows an authenticated user in one workspace to invoke another workspace's integration through the testConnection endpoint by supplying the target integration ID. The integration record is fetched in a bypass scope, and the caller's permission check matches any base in any workspace, defeating tenant isolation. The issue is tracked under [CWE-290: Authentication Bypass by Spoofing] and is fixed in NocoDB version 2026.05.1.

Critical Impact
Cross-workspace integration abuse enables low-privileged users to trigger connection tests against external systems configured in workspaces they should not access, exposing credential validation paths and remote endpoints.

Affected Products

NocoDB versions prior to 2026.05.1
Self-hosted NocoDB deployments with multi-workspace configurations
NocoDB instances exposing the testConnection API endpoint

Discovery Timeline

2026-06-23 - CVE-2026-47381 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-47381

Vulnerability Analysis

NocoDB implements workspaces as the top-level tenant boundary. Each workspace contains bases and integrations, and access control should enforce that users only interact with resources inside workspaces they belong to. The testConnection endpoint accepts an integration identifier and executes a connection test using the referenced integration's stored configuration. In vulnerable releases, the handler retrieves the integration in a bypass scope that does not constrain the lookup to the caller's workspace. The follow-up permission check then validates the caller against any base in any workspace, which always succeeds for an authenticated user with at least one base. The combination collapses the workspace boundary for this endpoint.

Root Cause

The root cause is an inconsistent authorization model between resource lookup and permission verification. The integration object is fetched with workspace-scope checks disabled, while the authorization gate accepts membership in any base globally rather than membership in the integration's owning workspace. This pattern matches [CWE-290], where an authorization decision is based on a property that an attacker controls or trivially satisfies.

Attack Vector

An authenticated attacker enumerates or guesses an integration ID belonging to a victim workspace. The attacker issues a request to the testConnection endpoint supplying that ID. NocoDB resolves the integration object, runs the loose permission check, and executes the connection test against the integration's configured target. The attacker observes timing, error responses, or connectivity outcomes to confirm validity of the foreign integration and probe the systems it points to.

No verified proof-of-concept code is published. See the GitHub Security Advisory GHSA-96fh-m4r8-6v9v for the maintainer's technical description.

Detection Methods for CVE-2026-47381

Indicators of Compromise

Requests to the NocoDB testConnection API endpoint where the authenticated user has no membership in the integration's owning workspace.
Unexpected outbound connection attempts originating from the NocoDB server to databases or services tied to integrations the requesting user should not access.
Spikes in failed testConnection responses correlated with sequential or enumerated integration IDs.

Detection Strategies

Correlate NocoDB application logs against the workspace membership table to flag testConnection invocations crossing workspace boundaries.
Alert on a single user account triggering connection tests against integrations belonging to multiple distinct workspaces in a short interval.
Review reverse-proxy or API gateway logs for high-volume POST requests targeting integration test endpoints.

Monitoring Recommendations

Enable verbose audit logging in NocoDB and forward records to a centralized SIEM for retention and correlation.
Monitor egress from the NocoDB host to integration endpoints (databases, REST APIs, S3 buckets) and baseline expected destinations per workspace.
Track authentication events and integration enumeration patterns to identify reconnaissance preceding cross-tenant abuse.

How to Mitigate CVE-2026-47381

Immediate Actions Required

Upgrade NocoDB to version 2026.05.1 or later, which contains the upstream fix from the maintainers.
Rotate credentials stored in any integration that may have been probed by untrusted users prior to patching.
Audit existing integrations and remove any unused connections that broaden the attack surface.

Patch Information

The vendor fix is delivered in NocoDB 2026.05.1. The patch tightens the integration lookup to the caller's workspace scope and replaces the global base-membership check with a workspace-scoped authorization decision. Refer to the NocoDB GHSA-96fh-m4r8-6v9v advisory for release notes and commit references.

Workarounds

Restrict network access to the NocoDB API so only trusted users can reach the testConnection endpoint until patching is complete.
Place an authenticating reverse proxy in front of NocoDB and enforce per-workspace path restrictions where feasible.
Disable or remove sensitive integrations from shared NocoDB instances if an immediate upgrade is not possible.

bash

# Upgrade NocoDB Docker deployment to the patched release
docker pull nocodb/nocodb:2026.05.1
docker stop nocodb && docker rm nocodb
docker run -d --name nocodb \
  -p 8080:8080 \
  -v nocodb_data:/usr/app/data \
  nocodb/nocodb:2026.05.1