CVE-2026-46550: NocoDB Refresh Token CSRF and HTTP Interception Vulnerability

Technical summary

The refresh-token cookie in NocoDB lacks two critical security attributes. Without the secure flag, browsers transmit the cookie over plaintext HTTP connections, exposing it to network-level interception (man-in-the-middle). Without the sameSite attribute, the cookie is included in cross-site POST requests, allowing an attacker to craft a malicious webpage that triggers token-refresh operations on behalf of an authenticated user. The httpOnly flag does prevent JavaScript exfiltration, limiting the attack surface, but this defense is incomplete. The vulnerability is classified under CWE-614 (Sensitive Cookie in HTTPS Session Without 'Secure' Attribute), reflecting the misconfiguration of session management controls.

Business impact

Users of NocoDB deployments exposed to unencrypted HTTP traffic face session hijacking risk. An attacker intercepting network traffic or exploiting CSRF could refresh a victim's authentication token, potentially maintaining or extending unauthorized access. For organizations using NocoDB in internal or hybrid environments, this may allow lateral movement or unauthorized data access. The impact is heightened in environments where HTTPS is not enforced or where users connect over public networks. Downstream integrations or API calls made with a compromised token could expose sensitive data or trigger unintended database modifications.

Affected systems

NocoDB versions prior to 2026.04.1 are affected. The httpOnly mitigation means only the token-refresh endpoint and network-based attack vectors are exposed—not client-side JavaScript exploitation. Systems running 2026.04.1 or later have received the fix and are not vulnerable through this vector.

Exploitability

Exploitability is practical but not trivial. An attacker must either position themselves on the network path (ARP spoofing, rogue WiFi, DNS hijacking) or successfully lure a user to a CSRF-capable webpage while the user has an active NocoDB session. The attack requires user interaction (clicking a malicious link or visiting a site while logged in), which is reflected in the CVSS vector's UI:R component. No authentication is required to craft the CSRF payload, but successful token refresh depends on the victim's authenticated state. The attack does not yield code execution or full data access denial, limiting the severity.

Remediation

Upgrade NocoDB to version 2026.04.1 or later. This release corrects the cookie configuration by adding the secure flag (to prevent HTTP transmission) and the sameSite attribute (to block cross-site attachment). Organizations unable to upgrade immediately should enforce HTTPS-only communication, disable HTTP access, and educate users to avoid clicking untrusted links while logged into NocoDB. Consider network segmentation or WAF rules to restrict token-refresh requests to expected origins.

Patch guidance

Apply NocoDB 2026.04.1 as soon as feasible. The fix is a configuration change with no expected breaking changes. Verify against the vendor advisory that your deployment method (Docker, binary, source) is covered. Test in a non-production environment first to confirm compatibility with your integrations and plugins. If you operate a self-hosted instance, pull the latest image or rebuild from source; if you use a managed service, confirm the provider has deployed the patch.

Detection guidance

Monitor HTTP-only (non-HTTPS) traffic to NocoDB endpoints, particularly the token-refresh path. Log and alert on unusual cross-site POST requests to refresh endpoints, or on token-refresh requests originating from unexpected referrer headers. Intrusion detection systems can flag suspicious cookie patterns or rapid token-refresh sequences. Network-based detection is limited if users are on compromised WiFi; endpoint logging of browser cookie transmission or referrer validation may reveal CSRF attempts. Compare your running version against the advisory to identify vulnerable installations.

Why prioritize this

This is a MEDIUM-severity vulnerability that warrants prompt remediation but is not a critical emergency. The attack requires network access or user interaction, and the impact is session-level rather than system-wide. However, the ease of exploitation in certain network environments (public WiFi, unsecured intranets) and the broad reach of NocoDB in data management use cases make it a reasonable priority for sprint planning. Organizations with strict HTTPS enforcement and no user access over untrusted networks face lower risk.

Risk score, explained

CVSS 3.1 score of 5.4 (MEDIUM) reflects: (1) Network Attack Vector—an attacker needs network access or ability to trick a user; (2) Low Attack Complexity—no special tools or timing required; (3) No Privilege Required; (4) User Interaction Required—the CSRF or network capture demands user presence or attacker positioning; (5) Limited Scope and Confidentiality/Integrity Impact—the attacker gains temporary session access, not the entire system. The absence of Availability impact (denial-of-service is not possible) and the bounded scope of token manipulation keep the score in the MEDIUM range.

Frequently asked questions