CVE-2026-126285: NocoDB before 2026.08.0 SQL Injection via Legacy where Query Filter
NocoDB before 2026.08.0 contains an sql injection vulnerability that allows authenticated users with read access to run arbitrary read queries via the legacy where parameter on PostgreSQL. Attackers, including Viewer-role users, can inject single quotes into filter values concatenated by CustomKnex.ts to read other tables, schemas, view-filtered rows, and hidden columns.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated NocoDB user with read access may be able to exploit it, including users assigned the Viewer role. The issue affects PostgreSQL deployments that accept the legacy where query parameter.
What access does an attacker need?
The attacker needs valid authentication and read access; no user interaction is required. They can inject single quotes into legacy where filter values to cause arbitrary read queries.
What data could be exposed?
An attacker may read data from other tables and schemas, rows excluded by views or filters, and hidden columns. The provided information describes confidentiality impact only, not modification or service-disruption impact.
Which versions are affected?
NocoDB versions before 2026.08.0 are affected according to the advisory information provided.