Uncontrolled Resource Consumption in NocoDB by NocoDB Team

CVE-2026-126272

What is CVE-2026-126272?

An uncontrolled resource consumption issue exists in NocoDB versions prior to 2026.09.0 that allows an authenticated user to bypass bulk row-count limits. This vulnerability arises because session authentication can be exploited instead of requiring API tokens. Users with Editor permissions can flood the database by submitting an excessive number of rows via the v1 and v2 bulk write endpoints, which may lead to performance degradation, resource exhaustion, and potential downtime. Securing access controls and monitoring usage of these endpoints is crucial to mitigate such risks.

References