CVE-2026-126270
Received Received - Intake

Authentication Bypass in NocoDB Exposes Metadata

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller.ts that exposes instance-wide metadata to anonymous callers. Unauthenticated attackers can request the endpoint to enumerate bases, user counts, shared and password-protected view counts, webhook counts, and live per-base row counts, while repeated requests amplify database query load.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126270
EUVD
EUVD-2026-125251

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nocodb nocodb to 2026.09.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

NocoDB before version 2026.09.1 has a missing authentication vulnerability in the aggregated meta info route. This allows unauthenticated attackers to access instance-wide metadata such as base counts, user counts, shared view details, webhook counts, and live row counts per base. The endpoint performs unfiltered SQL queries, which can also increase database load with repeated requests.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthenticated requests to the aggregated meta info endpoint in NocoDB. Check for repeated requests to /api/v1/db/meta/aggregated or similar paths. Use tools like curl to test if the endpoint returns metadata without authentication: curl -v http://<target>/api/v1/db/meta/aggregated

Inspect server logs for unusual access patterns to the utils.controller.ts aggregated meta route. High query loads or repeated requests may indicate exploitation attempts.

Impact Analysis

An attacker could exploit this to gather sensitive information about your NocoDB instance, including the number of users, databases, and active rows. This data could be used for further attacks or reconnaissance. High query loads from repeated requests may also degrade database performance.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive metadata, potentially violating GDPR (data protection) and HIPAA (health information privacy) by exposing system details that may aid in further data breaches or unauthorized access.

Mitigation Strategies

Immediately upgrade NocoDB to version 2026.09.1 or later to patch the missing authentication flaw. If upgrading is not possible, restrict access to the aggregated meta endpoint via network-level controls or disable the endpoint if unused.

Apply rate limiting and authentication checks to the affected route. Review and audit all API endpoints for similar missing authentication issues. Monitor database performance for unusual query loads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126270. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...