CVE-2026-28361: 
JavaScript vulnerability analysis and mitigation

CVE-2026-28361 is an authorization bypass vulnerability in NocoDB's MCP (Model Context Protocol) token service, classified as "Missing Ownership Validation in MCP Token Operations." It affects all NocoDB versions up to and including 0.301.2 (npm package), and was disclosed and patched on March 2, 2026. The flaw allows a Creator-role user within the same base to read, regenerate, or delete another user's MCP tokens if the token ID is known. It carries a CVSS v3.1 base score of 6.3 (Medium) and a CVSS v4.0 base score of 4.9 (Medium) (Github Advisory, NocoDB Advisory).

The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the McpTokenService.get(), regenerateToken(), and delete() methods did not filter operations by fk_user_id, meaning any caller with a valid token ID could act on tokens belonging to other users. In contrast, the analogous ApiTokensService correctly enforced ownership checks, highlighting an inconsistency in the codebase. Exploitation requires only a low-privilege Creator role within the same NocoDB base and knowledge of the target token's ID — no user interaction or special configuration is needed. The attack is conducted over the network with low complexity (NocoDB Advisory, Github Advisory).

A successful exploit allows a malicious Creator-role user to read another user's MCP token (scoped token disclosure), regenerate it to hijack persistent API access, or delete it to cause denial of service for the token owner. The primary risks are unauthorized data access via hijacked tokens and disruption of MCP-integrated workflows within shared NocoDB bases. Lateral movement within the same base is possible if an attacker leverages a stolen token to impersonate another user's MCP session (Github Advisory, NocoDB Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.053% (17th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for a Creator role within the target base and prior knowledge of the victim's token ID (Github Advisory).

1. Gain Creator Access: Obtain or already possess a Creator-level account within the target NocoDB base (e.g., via legitimate invitation or compromised credentials).
2. Enumerate Token IDs: Identify or enumerate MCP token IDs belonging to other users in the same base. Token IDs may be discoverable through API responses, shared logs, or social engineering.
3. Read Target Token: Send an authenticated API request to McpTokenService.get() with the target token ID. Because fk_user_id is not validated, the service returns the token details for any user.
4. Hijack or Disrupt: Use the retrieved token to impersonate the victim's MCP session for unauthorized data access, OR call regenerateToken() to invalidate the victim's existing token and capture the new one, OR call delete() to deny the victim access to their MCP integration (NocoDB Advisory, Github Advisory).

• Logs: API audit logs showing MCP token read, regeneration, or deletion requests where the requesting user's ID does not match the token owner's fk_user_id; repeated token operations on the same token ID from a different user account.
• Application Behavior: Unexpected MCP token invalidations reported by users who did not initiate regeneration or deletion; users losing MCP connectivity without self-initiated changes.
• Network: Unusual API calls to MCP token service endpoints (/api/v1/mcp/token/ or equivalent) from Creator-role accounts at abnormal times or frequencies.

Upgrade NocoDB to version 0.301.3 or later, which patches the missing ownership validation in McpTokenService.get(), regenerateToken(), and delete() by enforcing fk_user_id filtering. No configuration-based workaround is available for unpatched versions; the recommended action is immediate upgrade. As a precautionary measure, audit MCP token activity logs for versions prior to 0.301.3 and limit Creator role assignments to trusted users only (NocoDB Release, Github Advisory).

The vulnerability was responsibly reported by @bugbunny-research (bugbunny.ai) and acknowledged by the NocoDB maintainer @mertmit in the official security advisory. The NocoDB 0.301.3 release notes credit multiple security researchers for responsibly disclosing various vulnerabilities addressed in that release. No significant broader media coverage or notable community debate has been observed beyond the standard advisory publication (NocoDB Advisory, NocoDB Release).