CVE-2026-126285
Received Received - Intake

NocoDB PostgreSQL SQL Injection via Legacy Where Parameter

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
NocoDB before 2026.08.0 contains an sql injection vulnerability that allows authenticated users with read access to run arbitrary read queries via the legacy where parameter on PostgreSQL. Attackers, including Viewer-role users, can inject single quotes into filter values concatenated by CustomKnex.ts to read other tables, schemas, view-filtered rows, and hidden columns.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126285
EUVD
EUVD-2026-125236

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nocodb nocodb to 2026.08.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

NocoDB before version 2026.08.0 has an SQL injection flaw in its legacy where parameter for PostgreSQL databases. Authenticated users with read access can exploit this by injecting single quotes into filter values. The vulnerability occurs because CustomKnex.ts concatenates these values without proper sanitization, allowing attackers to execute arbitrary read queries.

Detection Guidance

To detect this SQL injection vulnerability in NocoDB, check for unusual database queries or unauthorized data access patterns. Monitor logs for requests containing legacy where parameter values with single quotes or suspicious SQL syntax. Review NocoDB version to confirm if it is below 2026.08.0.

Impact Analysis

This vulnerability allows attackers with read access to extract sensitive data from other tables, schemas, or hidden columns. Even users with Viewer roles can exploit it to bypass intended access controls and read restricted information, potentially leading to data breaches or unauthorized information disclosure.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling unauthorized access to personal or health data. GDPR requires protection against unauthorized data access, while HIPAA mandates strict controls for protected health information. Exploitation could result in regulatory penalties and loss of trust.

Mitigation Strategies

Immediately upgrade NocoDB to version 2026.08.0 or later to patch the SQL injection flaw. Restrict database user permissions to limit read access. Disable legacy where parameter usage if possible. Review and audit database access logs for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126285. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...