CVE-2026-126277: NocoDB before 2026.08.1 Uncontrolled Resource Consumption via Shared View Bulk API
NocoDB before 2026.08.1 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust server resources by sending unbounded filter arrays to shared-view bulk endpoints. Attackers with a shared view UUID can POST a large body of minimal filter objects, triggering a full database query per entry, to crash the NocoDB process.
Event History
Frequently Asked Questions
Who is exposed to exploitation?
NocoDB instances before 2026.08.1 with reachable shared-view bulk endpoints are exposed. An attacker must know a shared view UUID, but does not need to authenticate.
What does an attacker need to send?
The attacker can POST a large request body containing an unbounded array of minimal filter objects to a shared-view bulk endpoint. Each entry can trigger a full database query, allowing resource exhaustion and a NocoDB process crash.
Is confidentiality or data integrity affected?
The reported impact is availability only. The supplied vector and description indicate no confidentiality or integrity impact.