CVE-2026-126285

CVSS 8.3 (high) · published 2026-11-13

NocoDB before 2026.08.0 contains an sql injection vulnerability that allows authenticated users with read access to run arbitrary read queries via the legacy where parameter on PostgreSQL. Attackers, including Viewer-role users, can inject single quotes into filter values concatenated by CustomKnex.ts to read other tables, schemas, view-filtered rows, and hidden columns.

Weakness: CWE-89

Source: NVD CVE-2026-126285

References

• https://github.com/nocodb/nocodb/security/advisories/GHSA-f2jp-xg6f-hjf6
• https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-sql-injection-via-legacy-where-query-filter

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.