SB20261109118 - Multiple vulnerabilities in NocoDB

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109118

SB20261109118 - Multiple vulnerabilities in NocoDB

Published: November 9, 2026 Updated: November 13, 2026

Security Bulletin ID SB20261109118
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Origin validation error (CVE-ID: CVE-2026-126268)

CWE-ID: CWE-346 - Origin Validation Error

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to falsify source IP addresses in NocoDB audit logs, misleading investigation and attribution.

The vulnerability exists due to unconditional proxy trust in NocoDB's Express server, which accepts caller-supplied X-Forwarded-For headers as client addresses. An unauthenticated remote attacker can submit requests with forged forwarding headers when the instance is directly reachable or its proxy passes those headers unchanged, causing arbitrary IP addresses to be recorded.


2) Cross-site scripting (CVE-ID: CVE-2026-126274)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an authenticated attacker to execute script in a victim's browser, steal their session token, and access their data.

The vulnerability exists due to unescaped column and table titles rendered as HTML in NocoDB's deletion dialog for external data source tables with incoming link columns. An authenticated attacker with the base Creator role can store malicious titles that execute when a victim with the base Creator role or above confirms deletion of the referenced table.


3) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker with schema-edit permission to disclose internal database information.

The vulnerability exists due to NocoDB accepting column defaults resembling zero-argument function calls as raw SQL when creating or altering PostgreSQL or MySQL columns. An authenticated attacker with schema-edit permission, available to Creator or Owner base roles, can plant database functions and read their results after inserting rows without explicit column values.


Remediation

Install update from vendor's website.

References