Denial of Service Vulnerability in NocoDB by NocoDB
CVE-2026-126267

7.1HIGH

Key Information:

Vendor

Nocodb

Status
Nocodb
Vendor
CVE Published:
13 November 2026

What is CVE-2026-126267?

NocoDB versions earlier than 2026.04.4 contain a vulnerability that allows authenticated users to exploit a flaw in the MetaService metadata logging functionality, leading to a denial of service. By sending a specially crafted request with an undefined lookup condition, attackers can provoke knex binding errors due to unawaited logHelper calls, ultimately crashing the server. This affects the application's stability and availability.

Affected Version(s)

nocodb 0.300.0 < 2026.04.4

nocodb 2026.04.4

References

https://github.com/nocodb/nocodb/security/advisories/GHSA...
vendor-advisory
https://www.vulncheck.com/advisories/nocodb-from-0.300.0-...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

5255fgh
.