{"id":"CVE-2026-126285","kind":"vulnerability","aliases":["CVE-2026-126285"],"related":[],"title":"NocoDB: SQL injection lets read-only users query other PostgreSQL tables","description":"NocoDB before 2026.08.0 contains an sql injection vulnerability that allows authenticated users with read access to run arbitrary read queries via the legacy where parameter on PostgreSQL. Attackers, including Viewer-role users, can inject single quotes into filter values concatenated by CustomKnex.ts to read other tables, schemas, view-filtered rows, and hidden columns.","summary":"NocoDB before 2026.08.0 builds SQL from filter values through the legacy where parameter on PostgreSQL without escaping them. An authenticated user with read access, including Viewer-role accounts, can read other tables, schemas, hidden columns and rows that view filters should hide.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nocodb","package","postgresql","self-hosted"],"not_affected_if":["no-postgresql-backend","version-2026.08.0-or-later"],"how_to_check":"- Check the NocoDB version in use; versions before `2026.08.0` are listed as affected.\n- Confirm whether the instance is backed by PostgreSQL.\n- Review which accounts have read or Viewer access.","fix":"- NocoDB: upgrade to `2026.08.0` or later.","status":"open","published_at":"2026-11-13T10:17:32+00:00","first_seen_at":"2026-11-13T10:47:13+00:00","triaged_at":"2026-11-13T10:51:12+00:00","updated_at":"2026-11-13T10:51:12+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:51:12Z","model":"claude-haiku-5-5","output":{"fix":"- NocoDB: upgrade to `2026.08.0` or later.","reach":"network","title":"NocoDB: SQL injection lets read-only users query other PostgreSQL tables","impact":"high","summary":"NocoDB before 2026.08.0 builds SQL from filter values through the legacy where parameter on PostgreSQL without escaping them. An authenticated user with read access, including Viewer-role accounts, can read other tables, schemas, hidden columns and rows that view filters should hide.","audience":"businesses","category":"package","nicknames":[],"who_cares":["nocodb","postgresql","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads other tables, schemas and hidden columns from the database","analyst_note":"","how_to_check":"- Check the NocoDB version in use; versions before `2026.08.0` are listed as affected.\n- Confirm whether the instance is backed by PostgreSQL.\n- Review which accounts have read or Viewer access.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-2026.08.0-or-later","no-postgresql-backend"],"who_is_affected":"Self-hosted or managed NocoDB instances before 2026.08.0 that use PostgreSQL. Any user with read access, including Viewer-role accounts, can exploit it, so exposure depends on who holds an account. Instances on MySQL or SQLite are not described as affected in the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00074,"input_tokens":4622,"output_tokens":555,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126285':15A,18A '-2026':14A,17A '2026.08.0':27B,70C 'access':48B,82C 'account':53B 'allow':77C 'arbitrari':85C 'attack':95C 'authent':44B,78C 'build':28B 'column':60B,122C 'concaten':108C 'contain':71C 'customknex.ts':110C 'cve':13A,16A 'escap':41B 'filter':31B,65B,106C,118C 'hidden':59B,121C 'hide':67B 'host':24B 'includ':49B,96C 'inject':3A,74C,102C 'legaci':35B,90C 'let':4A 'nocodb':1A,19B,25B,68C 'packag':20B 'paramet':37B,92C 'postgresql':11A,21B,39B,94C 'queri':9A,87C 'quot':104C 'read':6A,47B,55B,81C,86C,112C 'read-on':5A 'role':52B,99C 'row':62B,119C 'run':84C 'schema':58B,115C 'self':23B 'self-host':22B 'singl':103C 'sql':2A,29B,73C 'tabl':12A,57B,114C 'user':8A,45B,79C,100C 'valu':32B,107C 'via':88C 'view':64B,117C 'view-filt':116C 'viewer':51B,98C 'viewer-rol':50B,97C 'vulner':75C 'without':40B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed NocoDB instances before 2026.08.0 that use PostgreSQL. Any user with read access, including Viewer-role accounts, can exploit it, so exposure depends on who holds an account. Instances on MySQL or SQLite are not described as affected in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","nocodb","package","postgresql","selfhosted"],"campaign_type":null,"search_a":"'-126285':15A,18A '-2026':14A,17A 'cve':13A,16A 'inject':3A 'let':4A 'nocodb':1A 'postgresql':11A 'queri':9A 'read':6A 'read-on':5A 'sql':2A 'tabl':12A 'user':8A","search_b":"'2026.08.0':27B 'access':48B 'account':53B 'authent':44B 'build':28B 'column':60B 'escap':41B 'filter':31B,65B 'hidden':59B 'hide':67B 'host':24B 'includ':49B 'legaci':35B 'nocodb':19B,25B 'packag':20B 'paramet':37B 'postgresql':21B,39B 'read':47B,55B 'role':52B 'row':62B 'schema':58B 'self':23B 'self-host':22B 'sql':29B 'tabl':57B 'user':45B 'valu':32B 'view':64B 'viewer':51B 'viewer-rol':50B 'without':40B","search_c":"'2026.08.0':70C 'access':82C 'allow':77C 'arbitrari':85C 'attack':95C 'authent':78C 'column':122C 'concaten':108C 'contain':71C 'customknex.ts':110C 'filter':106C,118C 'hidden':121C 'includ':96C 'inject':74C,102C 'legaci':90C 'nocodb':68C 'paramet':92C 'postgresql':94C 'queri':87C 'quot':104C 'read':81C,86C,112C 'role':99C 'row':119C 'run':84C 'schema':115C 'singl':103C 'sql':73C 'tabl':114C 'user':79C,100C 'valu':107C 'via':88C 'view':117C 'view-filt':116C 'viewer':98C 'viewer-rol':97C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T10:06:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126285","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126285","severity":null,"published_at":"2026-11-13T10:17:32+00:00","modified_at":"2026-11-13T10:17:32+00:00","first_seen_at":"2026-11-13T10:47:13+00:00","fetched_at":"2026-11-13T10:47:13+00:00","note":null}],"documents":[{"id":144899,"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-f2jp-xg6f-hjf6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T10:06:40+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144900,"url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-sql-injection-via-legacy-where-query-filter","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}