What is the CVSS score of CVE-2026-29198?

CVE-2026-29198 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Rocket Chat are affected by CVE-2026-29198?

Rocket.Chat versions before 8.3.0 contain a critical unauthenticated NoSQL injection vulnerability in the OAuth2 authentication module that allows attackers to impersonate the first user account…

How to fix or mitigate CVE-2026-29198?

Within 24 hours, disable the OAuth2 server in Rocket.Chat administration settings if not actively in use, or restrict network access to OAuth2 endpoints via firewall/WAF rules to whitelisted trusted applications only; simultaneously identify all Rocket.Chat instances with OAuth2 configured. Within 7 days, review authentication audit logs for suspicious token-based access patterns, particularly access_token parameters containing NoSQL operators (e.g., $ne, $gt, $regex); enable enhanced logging on OAuth2 authentication attempts. Within 30 days, monitor Rocket.Chat security advisories for patched versions (8.3.0, 8.2.1, 8.1.2, 8.0.3, 7.13.5, 7.12.6, 7.11.6, 7.10.9, or later) and execute immediate upgrade upon vendor release; until patched, maintain strict network segmentation and access controls on OAuth2 endpoints.

Rocket Chat CVE-2026-29198

EUVD-2026-25129 CRITICAL

SQL Injection (CWE-89)

2026-04-23 support@hackerone.com

GHSA-h257-f28j-hfjg

SQLi Rocket Chat

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 04:50 vuln.today

Analysis Generated

Jul 24, 2026 - 04:50 vuln.today

CVSS changed

Apr 23, 2026 - 18:42 NVD

9.8 (None) 9.8 (CRITICAL)

EUVD ID Assigned

Apr 23, 2026 - 00:22 euvd

EUVD-2026-25129

CVE Published

Apr 23, 2026 - 00:16 nvd

CRITICAL 9.8

DescriptionCVE.org

In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injection vulnerability can lead to account takeover of the first user with a generated token when an OAuth app is configured.

AnalysisAI

NoSQL injection in Rocket.Chat before 8.3.0 (and the 8.2.1, 8.1.2, 8.0.3, 7.13.5, 7.12.6, 7.11.6, and 7.10.9 maintenance releases) lets remote unauthenticated attackers take over the account of the first user holding a generated OAuth token when the built-in OAuth2 server has an app configured. The unsanitized access_token query parameter is passed into a MongoDB lookup, so operator injection (e.g. access_token[$ne]=null) matches a valid token without knowing it, authenticating the attacker as that user — typically the initial admin. There is no public exploit identified at time of analysis, though the fixing pull request and its regression tests openly disclose the exact injection payloads; EPSS is very low (0.01%, 3rd percentile) and CISA SSVC records no observed exploitation.