PT-2026-47084 · Git+2 · Nocodb

Eddieran · CVE-2026-47386 · Published 2026-06-05 · Updated 2026-06-25

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.05.1

Description A flaw in the token-exchange flow allows two concurrent requests using the same OAuth authorization code to each generate a distinct valid access token and refresh token pair. This occurs because the system previously read the is used status and performed the markAsUsed update unconditionally at the end of the process, failing the single-use guarantee of PKCE (Proof Key for Code Exchange), a security extension for OAuth 2.0. An attacker who observes an authorization code and the corresponding PKCE verifier could obtain a long-lived refresh token alongside the legitimate user.

Recommendations Update to version 2026.05.1.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-47386

GHSA-8M7C-HF24-5G47

Affected Products

Nocodb

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47386.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-47386 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8m7c-hf24-5g47 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47386 · Security Note
• https://github.com/nocodb/nocodb/security/advisories/GHSA-8m7c-hf24-5g47 · Note
• https://github.com/nocodb/nocodb · Note
• https://github.com/nocodb/nocodb/releases/tag/2026.05.1 · Note
• https://twitter.com/infoflowcloud/status/2069530049728897286 · Twitter Post
• https://twitter.com/CVEnew/status/2069529575512563931 · Twitter Post
• https://t.me/cveNotify/174489 · Telegram Post
• https://t.me/cveNotify/175184 · Telegram Post