{"id":"CVE-2026-126267","kind":"vulnerability","aliases":["CVE-2026-126267"],"related":[],"title":"NocoDB: authenticated request can crash the server process","description":"NocoDB from 0.300.0 before 2026.04.4 contains a denial of service vulnerability that allows authenticated users to crash the server by triggering an unhandled promise rejection in MetaService metadata logging. Attackers can send a request leaving a lookup condition undefined, causing knex binding errors in the unawaited logHelper call that terminate the server process.","summary":"NocoDB versions from 0.300.0 before 2026.04.4 have an unhandled promise rejection in metadata logging. An authenticated user can send a request with an undefined lookup condition and terminate the server process.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NocoDB","fixed":[],"affected":"","ecosystem":"vendor"},{"via":"cpe","name":"nocodb","fixed":[],"affected":"","ecosystem":"npm"}],"ecosystems":["npm","vendor"],"tags":["docker","nocodb","package","self-hosted"],"not_affected_if":["fixed-version","managed-hosting"],"how_to_check":"- Check the running NocoDB version against the affected range (`0.300.0` to before `2026.04.4`)\n- Look at the NocoDB image tag or package version in your deployment config","fix":"- Move to NocoDB `2026.04.4` or later","status":"open","published_at":"2026-11-13T10:17:29+00:00","first_seen_at":"2026-11-13T10:47:12+00:00","triaged_at":"2026-11-13T10:54:26+00:00","updated_at":"2026-11-13T11:20:09+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:54:26Z","model":"claude-haiku-5-5","output":{"fix":"- Move to NocoDB `2026.04.4` or later","reach":"network","title":"NocoDB: authenticated request can crash the server process","impact":"low","summary":"NocoDB versions from 0.300.0 before 2026.04.4 have an unhandled promise rejection in metadata logging. An authenticated user can send a request with an undefined lookup condition and terminate the server process.","audience":"businesses","category":"package","nicknames":[],"who_cares":["nocodb","self-hosted","docker"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Server process crashes, taking the NocoDB service offline until restarted","analyst_note":"","how_to_check":"- Check the running NocoDB version against the affected range (`0.300.0` to before `2026.04.4`)\n- Look at the NocoDB image tag or package version in your deployment config","plain_action":"","product_name":"NocoDB","needs_analyst":false,"not_affected_if":["fixed-version","managed-hosting"],"who_is_affected":"Teams that self-host NocoDB from 0.300.0 up to but not including 2026.04.4 and let users with accounts reach its API. Exposure needs a logged-in user; instances where only trusted staff have accounts carry less risk. Managed or upgraded instances at 2026.04.4 or later are not affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":4618,"output_tokens":520,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126267':11A,14A '-2026':10A,13A '0.300.0':26B,56C '2026.04.4':28B,58C 'allow':66C 'attack':83C 'authent':2A,38B,67C 'bind':95C 'call':101C 'caus':93C 'condit':48B,91C 'contain':59C 'crash':5A,70C 'cve':9A,12A 'denial':61C 'docker':17B 'error':96C 'host':22B 'knex':94C 'leav':88C 'log':36B,82C 'loghelp':100C 'lookup':47B,90C 'metadata':35B,81C 'metaservic':80C 'nocodb':1A,15A,16A,18B,23B,54C 'packag':19B 'process':8A,53B,106C 'promis':32B,77C 'reject':33B,78C 'request':3A,43B,87C 'self':21B 'self-host':20B 'send':41B,85C 'server':7A,52B,72C,105C 'servic':63C 'termin':50B,103C 'trigger':74C 'unawait':99C 'undefin':46B,92C 'unhandl':31B,76C 'user':39B,68C 'version':24B 'vulner':64C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host NocoDB from 0.300.0 up to but not including 2026.04.4 and let users with accounts reach its API. Exposure needs a logged-in user; instances where only trusted staff have accounts carry less risk. Managed or upgraded instances at 2026.04.4 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["nocodb"],"ptokens":["nocodb"],"labels":["docker","high","nocodb","npm","package","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126267':11A,14A '-2026':10A,13A 'authent':2A 'crash':5A 'cve':9A,12A 'nocodb':1A,15A,16A 'process':8A 'request':3A 'server':7A","search_b":"'0.300.0':26B '2026.04.4':28B 'authent':38B 'condit':48B 'docker':17B 'host':22B 'log':36B 'lookup':47B 'metadata':35B 'nocodb':18B,23B 'packag':19B 'process':53B 'promis':32B 'reject':33B 'request':43B 'self':21B 'self-host':20B 'send':41B 'server':52B 'termin':50B 'undefin':46B 'unhandl':31B 'user':39B 'version':24B","search_c":"'0.300.0':56C '2026.04.4':58C 'allow':66C 'attack':83C 'authent':67C 'bind':95C 'call':101C 'caus':93C 'condit':91C 'contain':59C 'crash':70C 'denial':61C 'error':96C 'knex':94C 'leav':88C 'log':82C 'loghelp':100C 'lookup':90C 'metadata':81C 'metaservic':80C 'nocodb':54C 'process':106C 'promis':77C 'reject':78C 'request':87C 'send':85C 'server':72C,105C 'servic':63C 'termin':103C 'trigger':74C 'unawait':99C 'undefin':92C 'unhandl':76C 'user':68C 'vulner':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T10:06:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126267","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126267","severity":null,"published_at":"2026-11-13T10:17:29+00:00","modified_at":"2026-11-13T10:17:29+00:00","first_seen_at":"2026-11-13T10:47:12+00:00","fetched_at":"2026-11-13T10:47:12+00:00","note":null}],"documents":[{"id":144863,"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-gcxw-8q43-jhjc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T10:06:56+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144864,"url":"https://www.vulncheck.com/advisories/nocodb-from-0.300.0-before-2026.04.4-denial-of-service-via-metaservice-logging","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}