CVE-2026-28361

Publication date

2026-03-02 16:17:50

Family

GitHub_M

State

PUBLISHED

Description

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the MCP token service did not validate token ownership, allowing a Creator within the same base to read, regenerate, or delete another users MCP tokens if the token ID was known. This issue has been patched in version 0.301.3.