CVE-2026-47388: NocoDB Information Disclosure Flaw

CVE-2026-47388 Overview

CVE-2026-47388 is an authorization bypass vulnerability in NocoDB, an open-source platform that turns databases into spreadsheets. The flaw resides in the Model Context Protocol (MCP) readAttachment tool, which fails to verify file ownership before returning attachment data. A low-privilege MCP token holder who knows or guesses an attachment path can read files belonging to other bases and workspaces stored in shared storage. The issue is classified as [CWE-639] Authorization Bypass Through User-Controlled Key. NocoDB version 2026.05.1 contains the fix.

Critical Impact
Authenticated low-privilege users can read arbitrary attachments across tenant boundaries, breaking workspace isolation in shared NocoDB deployments.

Affected Products

NocoDB versions prior to 2026.05.1
NocoDB deployments exposing the MCP readAttachment tool
Multi-tenant NocoDB installations using shared object or file storage

Discovery Timeline

2026-06-23 - CVE-2026-47388 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-47388

Vulnerability Analysis

NocoDB exposes a Model Context Protocol interface that lets clients call server-side tools using scoped MCP tokens. One of those tools, readAttachment, returns the contents of an attachment stored in NocoDB's shared storage layer. The vulnerable implementation accepts an attachment path from the caller and reads it directly from storage. It does not check whether the requesting token is authorized for the base or workspace that owns the file.

Because attachment paths are predictable or can be discovered through other API surfaces, any authenticated user with a valid MCP token can pivot from their own workspace to read files belonging to other tenants. This breaks the workspace and base isolation that NocoDB customers rely on for multi-tenant data segregation. The vulnerability is network-exploitable and requires low privileges with no user interaction.

Root Cause

The root cause is missing ownership validation on a user-controlled object reference, mapped to [CWE-639]. The readAttachment MCP tool trusts the supplied path and performs the read against shared storage without joining the path back to the caller's base, workspace, or token scope. Authorization is effectively reduced to possession of any valid MCP token.

Attack Vector

An attacker first obtains a low-privilege MCP token, either by holding a legitimate account in any workspace or by compromising a low-tier user. The attacker then invokes the readAttachment MCP tool with a path pointing to an attachment in another base or workspace. Paths can be enumerated, guessed from naming conventions, or harvested from leaked URLs, logs, or backups. The server returns the file contents regardless of cross-tenant ownership.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-xxpj-q764-9r6q for vendor-provided technical details.

Detection Methods for CVE-2026-47388

Indicators of Compromise

MCP readAttachment calls where the requested attachment path does not belong to the caller's base or workspace.
High-volume or sequential attachment path access patterns from a single MCP token.
Access to attachment paths from tokens that have never interacted with the parent base through normal API calls.

Detection Strategies

Audit NocoDB application logs for MCP tool invocations and correlate readAttachment calls with the token's authorized base and workspace IDs.
Alert on cross-tenant access patterns where one token reads attachments associated with multiple unrelated workspaces in a short window.
Replay historical logs against the post-patch ownership check to identify previously successful unauthorized reads.

Monitoring Recommendations

Forward NocoDB and reverse proxy logs to a centralized SIEM and retain them long enough to investigate disclosure scope.
Monitor object storage or filesystem access logs for spikes in attachment reads originating from the NocoDB application identity.
Track issuance and use of MCP tokens, and alert when low-privilege tokens invoke administrative or cross-workspace tools.

How to Mitigate CVE-2026-47388

Immediate Actions Required

Upgrade all NocoDB instances to version 2026.05.1 or later, which adds ownership verification in the MCP readAttachment tool.
Rotate existing MCP tokens after upgrade to invalidate any tokens that may have been used for unauthorized reads.
Review attachment access logs since the MCP feature was enabled and notify affected workspace owners if cross-tenant reads are observed.

Patch Information

The vendor fix is included in NocoDB 2026.05.1. The patched readAttachment implementation validates that the requested attachment belongs to a base and workspace the caller's MCP token is authorized for. See the NocoDB GitHub Security Advisory for upgrade guidance.

Workarounds

Disable the MCP integration on internet-facing NocoDB deployments until the upgrade to 2026.05.1 is complete.
Restrict MCP endpoint access at the reverse proxy or network layer to trusted administrative networks.
Revoke MCP tokens issued to low-privilege users where the MCP interface is not required for their workflow.

bash

# Configuration example: block MCP endpoints at the reverse proxy until patched
# nginx snippet
location /api/v2/meta/mcp/ {
    deny all;
    return 403;
}