Prototype Pollution Vulnerability in NocoDB by NocoDB Inc.

CVE-2026-24766

What is CVE-2026-24766?

NocoDB, a tool designed to transform databases into spreadsheets, contains a prototype pollution vulnerability affecting users with org-level-creator permissions. This vulnerability is present in the /api/v2/meta/connection/test endpoint, where an attacker can exploit the system to disrupt all database write operations across the application until a server restart occurs. Although it bypasses SUPER_ADMIN authorization checks, no significant privileged actions can be executed due to the immediate failure of database operations. Users are urged to upgrade to version 0.301.0 or later to mitigate this risk.

References