PT-2026-146603

CVE-2026-126272

Published

2026-11-13

Updated

2026-11-13

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.09.0

Description An uncontrolled resource consumption issue exists where authenticated users can bypass bulk row-count limits by utilizing session authentication rather than API tokens. An attacker with Editor write permissions on a table can submit an excessive number of rows to the 'v1' and 'v2' bulk write endpoints, leading to the exhaustion of CPU, memory, and database connections.

Recommendations Update NocoDB to version 2026.09.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Iaohkut-From-Nightwolf-Team

Vendors

Affected products

Weakness enumeration

CWE-770: Allocation of Resources Without Limits or Throttling

Related identifiers