Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a low-privilege MCP token holder with knowledge of an attachment path could read any file in shared storage, including attachments belonging to other bases and workspaces, because the MCP readAttachment tool did not verify the file's ownership. This vulnerability is fixed in 2026.05.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-23 | 2 | Disclosure2 |
| 2026-06-24 | 1 | General1 |
CVE-2026-47388 Unauthorized File Access in NocoDB Prior to 2026.05.1 via MCP Token https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-47388
Post summary
The entry gives a concise description of CVE‑2026‑47388 as unauthorized file access in NocoDB, but offers no evidence of PoC, exploit, active use, patching, or false‑positive status.
🚨*CVE* CVE-2026-47388 NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a low-privilege MCP token holder with knowledge of an attachment path could read any fi… https://www.cve.org/CVERecord?id=CVE-2026-47388 ----- Traducción: CVE-2026-47388 Noc… http://infoflow.cloud`
Post summary
CVE-2026-47388 discloses a file‑read vulnerability in NocoDB for low‑privilege MCP token holders, as detailed in the linked CVE entry.
CVE-2026-47388 NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a low-privilege MCP token holder with knowledge of an attachment path could read any fi… https://www.cve.org/CVERecord?id=CVE-2026-47388
Post summary
CVE-2026-47388 enables low‑privilege MCP token holders to read any file via known attachment paths, but the text contains no PoC, exploit details, or patch information.