Uncontrolled Resource Consumption in NocoDB

Executive Summary

CVE-2026-126277 is an uncontrolled resource consumption vulnerability in NocoDB versions before 2026.08.1. It allows unauthenticated attackers to crash the NocoDB process by sending unbounded filter arrays to shared-view bulk endpoints. The API processes a filter array without length restrictions, executing a full database query for each element in the array. This leads to excessive CPU and memory usage, causing a denial-of-service condition.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusual spikes in CPU, memory usage, or database query counts originating from NocoDB processes. Check NocoDB logs for repeated requests to shared-view bulk endpoints with large filter arrays. Use network monitoring tools to detect POST requests to /api/v1/db/data/bulk or similar bulk endpoints with payloads exceeding normal sizes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing your NocoDB server to crash or become unresponsive. Attackers can exploit it to consume excessive server resources, leading to downtime and degraded performance. Since no authentication is required, any attacker with access to a shared view UUID can trigger this issue, potentially disrupting your services.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NocoDB to version 2026.08.1 or later immediately. If upgrading is not possible, restrict access to shared-view bulk endpoints by implementing network-level controls or disabling public shared views. Monitor API traffic for suspicious bulk requests and set up rate limiting or request size limits on the NocoDB server.

Useful 0 Not Useful 0