{"id":"CVE-2026-126272","kind":"vulnerability","aliases":["CVE-2026-126272"],"related":[],"title":"NocoDB: session auth bypasses bulk row limits, letting editors exhaust resources","description":"NocoDB before 2026.09.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass bulk row-count limits by using session authentication instead of API tokens. Attackers with Editor write permission on one table can submit hundreds of thousands of rows to v1 and v2 bulk write routes, exhausting database connections, CPU, and memory.","summary":"NocoDB before 2026.09.0 lets an authenticated user skip the bulk row-count limit by using session authentication instead of API tokens. An Editor with write access to one table can submit hundreds of thousands of rows, exhausting database connections, CPU and memory.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","nocodb","self-hosted"],"not_affected_if":["managed-hosting-patched","no-editor-users"],"how_to_check":"- Check the running NocoDB version in the deployment, for example the image tag or `package.json` version, and compare it with `2026.09.0`.\n- Confirm which accounts hold Editor permission on tables.","fix":"- NocoDB versions before `2026.09.0` are affected; move to `2026.09.0` or later (per the NVD description).","status":"open","published_at":"2026-11-13T10:17:30+00:00","first_seen_at":"2026-11-13T10:47:12+00:00","triaged_at":"2026-11-13T10:53:21+00:00","updated_at":"2026-11-13T10:53:21+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-13T10:53:21Z","model":"claude-haiku-5-5","output":{"fix":"- NocoDB versions before `2026.09.0` are affected; move to `2026.09.0` or later (per the NVD description).","reach":"network","title":"NocoDB: session auth bypasses bulk row limits, letting editors exhaust resources","impact":"medium","summary":"NocoDB before 2026.09.0 lets an authenticated user skip the bulk row-count limit by using session authentication instead of API tokens. An Editor with write access to one table can submit hundreds of thousands of rows, exhausting database connections, CPU and memory.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["nocodb","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated editor exhausts database connections, CPU and memory","analyst_note":"","how_to_check":"- Check the running NocoDB version in the deployment, for example the image tag or `package.json` version, and compare it with `2026.09.0`.\n- Confirm which accounts hold Editor permission on tables.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting-patched","no-editor-users"],"who_is_affected":"Self-hosted or cloud NocoDB deployments before 2026.09.0 where users have Editor permission on tables. Exposure depends on users with write access to a table being able to reach the bulk write routes with a session.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000727,"input_tokens":4622,"output_tokens":529,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126272':14A,17A '-2026':13A,16A '2026.09.0':27B,70C 'access':51B 'ai':19B 'ai-tool':18B 'allow':78C 'api':45B,94C 'attack':96C 'auth':3A 'authent':30B,42B,79C,91C 'bulk':5A,34B,83C,115C 'bypass':4A,82C 'connect':64B,120C 'consumpt':75C 'contain':71C 'count':37B,86C 'cpu':65B,121C 'cve':12A,15A 'databas':63B,119C 'editor':9A,48B,98C 'exhaust':10A,62B,118C 'host':24B 'hundr':57B,106C 'instead':43B,92C 'let':8A,28B 'limit':7A,38B,87C 'memori':67B,123C 'nocodb':1A,21B,25B,68C 'one':53B,102C 'permiss':100C 'resourc':11A,74C 'rout':117C 'row':6A,36B,61B,85C,110C 'row-count':35B,84C 'self':23B 'self-host':22B 'session':2A,41B,90C 'skip':32B 'submit':56B,105C 'tabl':54B,103C 'thousand':59B,108C 'token':46B,95C 'tool':20B 'uncontrol':73C 'use':40B,89C 'user':31B,80C 'v1':112C 'v2':114C 'vulner':76C 'write':50B,99C,116C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or cloud NocoDB deployments before 2026.09.0 where users have Editor permission on tables. Exposure depends on users with write access to a table being able to reach the bulk write routes with a session.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","high","nocodb","selfhosted"],"campaign_type":null,"search_a":"'-126272':14A,17A '-2026':13A,16A 'auth':3A 'bulk':5A 'bypass':4A 'cve':12A,15A 'editor':9A 'exhaust':10A 'let':8A 'limit':7A 'nocodb':1A 'resourc':11A 'row':6A 'session':2A","search_b":"'2026.09.0':27B 'access':51B 'ai':19B 'ai-tool':18B 'api':45B 'authent':30B,42B 'bulk':34B 'connect':64B 'count':37B 'cpu':65B 'databas':63B 'editor':48B 'exhaust':62B 'host':24B 'hundr':57B 'instead':43B 'let':28B 'limit':38B 'memori':67B 'nocodb':21B,25B 'one':53B 'row':36B,61B 'row-count':35B 'self':23B 'self-host':22B 'session':41B 'skip':32B 'submit':56B 'tabl':54B 'thousand':59B 'token':46B 'tool':20B 'use':40B 'user':31B 'write':50B","search_c":"'2026.09.0':70C 'allow':78C 'api':94C 'attack':96C 'authent':79C,91C 'bulk':83C,115C 'bypass':82C 'connect':120C 'consumpt':75C 'contain':71C 'count':86C 'cpu':121C 'databas':119C 'editor':98C 'exhaust':118C 'hundr':106C 'instead':92C 'limit':87C 'memori':123C 'nocodb':68C 'one':102C 'permiss':100C 'resourc':74C 'rout':117C 'row':85C,110C 'row-count':84C 'session':90C 'submit':105C 'tabl':103C 'thousand':108C 'token':95C 'uncontrol':73C 'use':89C 'user':80C 'v1':112C 'v2':114C 'vulner':76C 'write':99C,116C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T10:06:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126272","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126272","severity":null,"published_at":"2026-11-13T10:17:30+00:00","modified_at":"2026-11-13T10:17:30+00:00","first_seen_at":"2026-11-13T10:47:12+00:00","fetched_at":"2026-11-13T10:47:12+00:00","note":null}],"documents":[{"id":144873,"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-mmvm-m83w-6684","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T10:06:10+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144874,"url":"https://www.vulncheck.com/advisories/nocodb-before-2026.09.0-uncontrolled-resource-consumption-via-bulk-record-endpoints","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}