CVE-2026-28360: 
JavaScript vulnerability analysis and mitigation

CVE-2026-28360 is a plaintext password storage vulnerability in NocoDB, an open-source platform for building databases as spreadsheets. Shared view passwords were stored unhashed in the nc_views database table and compared using direct string equality (!==), rather than a secure hashing mechanism. All NocoDB versions up to and including 0.301.2 (npm package) are affected. The vulnerability was disclosed on March 2, 2026, and carries a CVSS v3.1 score of 5.3 (Medium) and a CVSS v4.0 score of 2.7 (Low) (GitHub Advisory, NocoDB Advisory).

The root cause is classified as CWE-256 (Plaintext Storage of a Password). The password column in the nc_views database table stored shared view passwords in cleartext, and verification logic across public-datas.service.ts, public-metas.service.ts, and calendar-datas.service.ts used direct string equality comparison (!==) rather than a constant-time cryptographic comparison of hashed values. This design flaw means that any attacker who gains read access to the NocoDB database can immediately retrieve all shared view passwords in plaintext. Additionally, the use of non-constant-time string comparison introduces a theoretical timing side-channel that could allow password guessing attacks (NocoDB Advisory, GitHub Advisory).

The primary impact is a confidentiality breach: if the NocoDB database is compromised, all shared view passwords are immediately readable in plaintext, enabling unauthorized access to any password-protected shared views and the data they expose. The risk is further amplified by password reuse scenarios, where the same password may protect other systems or accounts. There is no direct integrity or availability impact from this vulnerability itself, but unauthorized access to shared views could expose sensitive business data stored within NocoDB (NocoDB Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability requires prior database access to exploit, which significantly limits the attack surface. The EPSS score is approximately 0.044% (14th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Gain database access: Obtain read access to the NocoDB backend database (e.g., SQLite, MySQL, or PostgreSQL) through a separate vulnerability, misconfiguration, credential theft, or insider access.
2. Query the nc_views table: Execute a SQL query such as SELECT id, title, password FROM nc_views WHERE password IS NOT NULL; to retrieve all shared views that have passwords set.
3. Retrieve plaintext passwords: Since passwords are stored unhashed, the query results directly yield usable plaintext credentials for each password-protected shared view.
4. Access protected shared views: Use the retrieved passwords to authenticate to any NocoDB shared view URL, gaining unauthorized access to the data contained within those views.
5. Attempt password reuse: Test the recovered passwords against other services or accounts associated with the same users, as the advisory notes that risk is amplified in password reuse scenarios (NocoDB Advisory).

• Database: Unexpected or unauthorized queries against the nc_views table, particularly SELECT statements targeting the password column; review database audit logs if enabled.
• Logs: Unusual authentication attempts against shared view URLs, especially from unfamiliar IP addresses or at unusual times; NocoDB application logs showing repeated access to password-protected shared views.
• Network: Anomalous outbound connections from the database server; unexpected database client connections from non-application hosts.

Upgrade NocoDB to version 0.301.3 or later, which patches this vulnerability by implementing proper password hashing for shared view passwords (NocoDB Release). After upgrading, rotate all shared view passwords to ensure previously exposed plaintext values are no longer valid. As an interim measure prior to patching, restrict database access to only authorized application accounts and audit database access logs for any unauthorized queries against the nc_views table (NocoDB Advisory).

The vulnerability was responsibly reported by researcher @Tulgaaaaaaaa and was addressed as part of a broader security fix release (0.301.3) that acknowledged multiple researchers including contributors from GitHub Security Lab and bugbunny.ai (NocoDB Release). No significant broader media coverage or notable community commentary beyond the standard advisory publication has been identified.