CVE-2026-28360: NocoDB has Plaintext Storage of Shared View Passwords

March 2, 2026 (updated November 5, 2026)

Shared view passwords were stored in plaintext in the database and compared using direct string equality.

References

github.com/advisories/GHSA-mpp2-x7wv-38hv
github.com/nocodb/nocodb/commit/2476df4aed4ae8f6da61612ffe34177364631760
github.com/nocodb/nocodb/releases/tag/0.301.3
github.com/nocodb/nocodb/security/advisories/GHSA-mpp2-x7wv-38hv
nvd.nist.gov/vuln/detail/CVE-2026-28360

Code Behaviors & Features

Detect and mitigate CVE-2026-28360 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →