CVE-2026-126267

EUVD-2026-125254
NocoDB from 0.300.0 before 2026.04.4 contains a denial of service vulnerability that allows authenticated users to crash the server by triggering an unhandled promise rejection in MetaService metadata logging. Attackers can send a request leaving a lookup condition undefined, causing knex binding errors in the unawaited logHelper call that terminate the server process.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 29.48%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
nocodbnocodb
0.300.0 ≤
𝑥
< 2026.4.4
CNA
Common Weakness Enumeration
References
https://github.com/nocodb/nocodb/security/advisories/GHSA-gcxw-8q43-jhjc
https://www.vulncheck.com/advisories/nocodb-from-0.300.0-before-2026.04.4-denial-of-service-via-metaservice-logging