---
id: "CVE-2026-126285"
page: "https://infrastack.ai/live/CVE-2026-126285"
kind: "vulnerability"
aliases: ["CVE-2026-126285"]
title: "NocoDB: SQL injection lets read-only users query other PostgreSQL tables"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["nocodb", "package", "postgresql", "self-hosted"]
not_affected_if: ["no-postgresql-backend", "version-2026.08.0-or-later"]
published_at: "2026-11-13T10:17:32+00:00"
first_seen_at: "2026-11-13T10:47:13+00:00"
updated_at: "2026-11-13T10:51:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126285", "first_seen_at": "2026-11-13T10:47:13+00:00"}]
exploit_sources: []
---

# NocoDB: SQL injection lets read-only users query other PostgreSQL tables

Link for people: https://infrastack.ai/live/CVE-2026-126285 (this .md is for agents)

NocoDB before 2026.08.0 builds SQL from filter values through the legacy where parameter on PostgreSQL without escaping them. An authenticated user with read access, including Viewer-role accounts, can read other tables, schemas, hidden columns and rows that view filters should hide.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the NocoDB version in use; versions before `2026.08.0` are listed as affected.
- Confirm whether the instance is backed by PostgreSQL.
- Review which accounts have read or Viewer access.

## Fix

- NocoDB: upgrade to `2026.08.0` or later.

## Timeline

- 2026-11-13T10:47:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126285

## Documents

- [advisory] Vendor advisory: github.com https://github.com/nocodb/nocodb/security/advisories/GHSA-f2jp-xg6f-hjf6
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-sql-injection-via-legacy-where-query-filter

## From the sources

NocoDB before 2026.08.0 contains an sql injection vulnerability that allows authenticated users with read access to run arbitrary read queries via the legacy where parameter on PostgreSQL. Attackers, including Viewer-role users, can inject single quotes into filter values concatenated by CustomKnex.ts to read other tables, schemas, view-filtered rows, and hidden columns.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_