---
id: "CVE-2026-126272"
page: "https://infrastack.ai/live/CVE-2026-126272"
kind: "vulnerability"
aliases: ["CVE-2026-126272"]
title: "NocoDB: session auth bypasses bulk row limits, letting editors exhaust resources"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "nocodb", "self-hosted"]
not_affected_if: ["managed-hosting-patched", "no-editor-users"]
published_at: "2026-11-13T10:17:30+00:00"
first_seen_at: "2026-11-13T10:47:12+00:00"
updated_at: "2026-11-13T10:53:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126272", "first_seen_at": "2026-11-13T10:47:12+00:00"}]
exploit_sources: []
---

# NocoDB: session auth bypasses bulk row limits, letting editors exhaust resources

Link for people: https://infrastack.ai/live/CVE-2026-126272 (this .md is for agents)

NocoDB before 2026.09.0 lets an authenticated user skip the bulk row-count limit by using session authentication instead of API tokens. An Editor with write access to one table can submit hundreds of thousands of rows, exhausting database connections, CPU and memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running NocoDB version in the deployment, for example the image tag or `package.json` version, and compare it with `2026.09.0`.
- Confirm which accounts hold Editor permission on tables.

## Fix

- NocoDB versions before `2026.09.0` are affected; move to `2026.09.0` or later (per the NVD description).

## Timeline

- 2026-11-13T10:47:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126272

## Documents

- [advisory] Vendor advisory: github.com https://github.com/nocodb/nocodb/security/advisories/GHSA-mmvm-m83w-6684
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/nocodb-before-2026.09.0-uncontrolled-resource-consumption-via-bulk-record-endpoints

## From the sources

NocoDB before 2026.09.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass bulk row-count limits by using session authentication instead of API tokens. Attackers with Editor write permission on one table can submit hundreds of thousands of rows to v1 and v2 bulk write routes, exhausting database connections, CPU, and memory.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_