CVE-2026-126272: NocoDB before 2026.09.0 Uncontrolled Resource Consumption via Bulk Record Endpoints
NocoDB before 2026.09.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass bulk row-count limits by using session authentication instead of API tokens. Attackers with Editor write permission on one table can submit hundreds of thousands of rows to v1 and v2 bulk write routes, exhausting database connections, CPU, and memory.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated user with Editor write permission on at least one table can exploit it. No additional user interaction is required.
Are API-token-based bulk requests affected in the same way?
The described limit bypass relies on session authentication instead of API tokens. API-token requests are not identified as bypassing the bulk row-count limits.
What is the operational impact of exploitation?
An attacker can submit hundreds of thousands of rows through v1 and v2 bulk write routes. This can exhaust database connections, CPU, and memory, causing denial of service.
What versions need remediation?
NocoDB versions before 2026.09.0 are affected. Upgrading to 2026.09.0 or later addresses the affected version range described.