CVE-2026-47379
Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared-view password check fell back to strict-equality (===) comparison for legacy plaintext passwords, leaking the password's length and per-character prefix through response timing. This vulnerability is fixed in 2026.05.1.
Summary dbcve.org
NocoDB shared-view password authentication uses strict equality (===) comparison for legacy plaintext passwords, which leaks information through response timing. The === operator short-circuits on first character mismatch, allowing attackers to determine password length and incrementally discover the password prefix by measuring response times across character variations.
Mitigation
Upgrade to NocoDB version 2026.05.1 or later, which implements constant-time comparison for legacy passwords. If immediate upgrade is not feasible, implement a constant-time string comparison function to replace the === operator in the password verification logic.