SZB-af07f18cd8
EUVD lists clickjacking flaw in NocoDB before 2026.08.0
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- nocodb
- Product
- NocoDB
- First seen
Summary
The EUVD entry EUVD-2026-114120 (CVSS v3.1 score 5.3) reports a clickjacking vulnerability in NocoDB. According to the entry, the application sends no X-Frame-Options or CSP frame-ancestors headers, so any origin can frame the authenticated interface.
If you use nocodb
Upgrade NocoDB to version 2026.08.0 or later
Add X-Frame-Options or CSP frame-ancestors headers at the proxy as an interim control
Avoid using NocoDB sessions while browsing untrusted sites
What the sources say 1
· Mastodon: “NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to frame the authenticated interface because no X-Frame-Options or CSP frame-ancestors headers are sent.” Source