CVE-2026-126285 · Package
NO FIX YET · SEE WHAT TO DO
NocoDB before 2026.08.0 builds SQL from filter values through the legacy where parameter on PostgreSQL without escaping them. An authenticated user with read access, including Viewer-role accounts, can read other tables, schemas, hidden columns and rows that view filters should hide.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted or managed NocoDB instances before 2026.08.0 that use PostgreSQL. Any user with read access, including Viewer-role accounts, can exploit it, so exposure depends on who holds an account. Instances on MySQL or SQLite are not described as affected in the sources.
Not affected if no-postgresql-backend, version-2026.08.0-or-later
Who cares nocodb, postgresql, self-hosted
2026.08.0 are listed as affected.2026.08.0 or later.NocoDB before 2026.08.0 contains an sql injection vulnerability that allows authenticated users with read access to run arbitrary read queries via the legacy where parameter on PostgreSQL. Attackers, including Viewer-role users, can inject single quotes into filter values concatenated by CustomKnex.ts to read other tables, schemas, view-filtered rows, and hidden columns.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.