SQL injection in NocoDB - CVE-2026-28399
Published: April 27, 2026
Vulnerability identifier: #VU127988
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-28399
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose or modify data in the connected database.
The vulnerability exists due to SQL injection in the DATEADD formula handling when processing the unit parameter. A remote user can supply a crafted DATEADD formula to disclose or modify data in the connected database.
The issue affects MySQL, PostgreSQL, and SQLite function mappings, and exploitation requires Creator role privileges.
Affected software
NocoDB
How to mitigate CVE-2026-28399
Install security update from vendor's website.
NocoDB - update to 0.301.3