NOCODB · CVE-2026-126277 · Package
NO FIX YET · SEE WHAT TO DO
NocoDB before 2026.08.1 accepts very large filter arrays on shared-view bulk endpoints, running a full database query for each entry. An unauthenticated attacker who holds a shared view UUID can send one large request and crash the NocoDB process.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted or cloud NocoDB deployments running a version before 2026.08.1 that expose shared views. An attacker needs a shared view UUID, which is not guessable but can be obtained by anyone the link has been shared with. Instances without public shared views are much less exposed.
Not affected if no-shared-views, version-2026.08.1-or-later
Who cares database-ui, low-code, nocodb, self-hosted
npm ls nocodb if run from source; versions before 2026.08.1 are exposed.2026.08.1 or later.NocoDB before 2026.08.1 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust server resources by sending unbounded filter arrays to shared-view bulk endpoints. Attackers with a shared view UUID can POST a large body of minimal filter objects, triggering a full database query per entry, to crash the NocoDB process.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.