SQL injection in NocoDB - #VU162896
Published: November 9, 2026
Vulnerability identifier: #VU162896
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker with schema-edit permission to disclose internal database information.
The vulnerability exists due to NocoDB accepting column defaults resembling zero-argument function calls as raw SQL when creating or altering PostgreSQL or MySQL columns. An authenticated attacker with schema-edit permission, available to Creator or Owner base roles, can plant database functions and read their results after inserting rows without explicit column values.
Affected software
NocoDB
Remediation
Install security update from vendor's website.
NocoDB - update to 2026.08.0