Airtable MCP CLI

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical │ $3,500 │ $4,375 High │ $750 │ $938 Medium │ $400 │ $500 Low │ $200 │ $250 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Access control 35 % Auth bypass 25 % Info disclosure 25 % Injection 10 % Latest advisories Loading the feed Overview The Airtable MCP CLI is the officially blessed way to connect an agent to Airtable bases, and although the repository is small by the usual signals, 26 stars, version 0.2.6, the per-install stakes are not. Airtable is the operational database for a very large number of non-engineering teams, and every install of this CLI carries a personal access token scoped to workspaces holding CRM, HR and finance records, so a token-handling or authorization defect turns one developer's laptop into a route into a company's records. Airtable pays for it on HackerOne, where the package has its own source-code scope row and the program's single unbound bounty row runs $200 for a low up to $3,500 for a critical. sorona.xyz adds 1.25× on top of whatever Airtable awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Airtable's scope list carries npm @airtable/mcp-cli as a bounty-eligible source-code asset in its own right, instruction "Source code for our MCP CLI.", maximum severity critical. Any security issue in Airtable/airtable-mcp-cli is accepted The whole of the CLI as shipped: configuration and credential handling, the personal access token it is given, the MCP transport it speaks, and every tool it exposes to the agent driving it mcp.staging.airtable.com , the MCP server the CLI talks to, whose own instruction repeats that the CLI code is in scope alongside it The airtable.js SDK published as npm airtable , a second bounty-eligible source-code row on the same program The staging web app and API the two of them run against: staging.airtable.com , api-staging.airtable.com and the *.staging.airtable.com wildcard, each carried at critical *.staging-airtableblocks.com , the custom apps and blocks domain, also bounty-eligible at critical Enterprise admin surfaces under staging.airtable.com/admin , including service accounts and user groups Out of scope Anything tested against production airtable.com , which the scope list marks ineligible and the SDK instruction is emphatic about The marketing and support properties: the blog, support, guide, community and dl subdomains, and the Airtable macOS app, all carried at severity none and not bounty-eligible Stored XSS reached through the custom apps and blocks functionality on *.staging-airtableblocks.com , which that scope row rules out by name DMARC, DKIM, SPF and DNSSEC configuration findings Session cookie duration and password policy complaints Two-factor bypass that depends on a third-party sign-in such as Google Self-XSS, Referer leakage and exploits that only work on legacy browsers, all treated as Low severity at best Vulnerabilities in third-party services, which do not qualify for the published reward amounts and are assessed case by case instead Most-valued findings An authorization flaw where an MCP tool call reaches a base, table or record outside what the caller's token actually grants. The largest class on this target at 35%, and the shape a critical takes here Personal access token compromise through the CLI: a token forwarded to the wrong endpoint, handed to a hostile MCP server, or accepted from an unauthenticated caller Tool or prompt injection where untrusted record content read out of a base steers the CLI into a privileged action the operator never asked for Token or base contents leaking into logs, config files, shell history or a shared cache, which is a quarter of the published class distribution here Enterprise admin flaws on the staging admin surface, across service accounts and user groups, that let a member grant themselves access over a whole workspace Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. All testing must target staging.airtable.com and mcp.staging.airtable.com; production airtable.com is explicitly out of scope When exercising the SDK you must set the endpointUrl attribute to the staging URL, or as the scope instruction puts it you will be testing on airtable.com, which is out of scope Generate API credentials from the staging account page rather than reusing a production token Do not disclose any issue to the public or to any third party without Airtable's permission Vulnerabilities in third-party services are not eligible for the default reward amounts and are assessed case by case Program stats 261 Reports resolved $144k Bounties paid 82% Response efficiency Disclosure Airtable bars disclosure to the public or to any third party without its permission, so file directly with Airtable on HackerOne first. sorona.xyz will not publish or share anything about the finding while that permission is outstanding, and only helps you track the report once Airtable holds it. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability