Uncaught Exception in NocoDB - CVE-2026-126267
Published: November 9, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU162865
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126267
CWE-ID: CWE-248
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated remote attacker to terminate the NocoDB server process and deny service to all users.
The vulnerability exists due to an unhandled promise rejection in metadata query logging when incomplete request input leaves a lookup condition undefined. An authenticated remote attacker can send a single request with missing lookup input to trigger the error and leave the entire instance unavailable until restarted.
Affected software
NocoDB
How to mitigate CVE-2026-126267
Install security update from vendor's website.
NocoDB - update to 2026.04.4