CVE-2026-126270 · Package
NO FIX YET · SEE WHAT TO DO
NocoDB before 2026.09.1 has an aggregated meta info route in utils.controller.ts that skips authentication. An anonymous caller can read instance-wide counts of bases, users, views, webhooks and per-base rows, and repeated requests can load the database.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any self-hosted or cloud NocoDB instance running a version before 2026.09.1 that exposes its API to the network is affected. Instances reachable only from a private network with no public exposure carry less risk. The sources do not say whether the flaw depends on any non-default setting.
Not affected if patched-version
Who cares databases, nocodb, self-hosted
Unknown from the sources.
2026.09.1 or laterNocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller.ts that exposes instance-wide metadata to anonymous callers. Unauthenticated attackers can request the endpoint to enumerate bases, user counts, shared and password-protected view counts, webhook counts, and live per-base row counts, while repeated requests amplify database query load.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.