CVE-2026-24766
📋 TL;DR
An authenticated user with org-level-creator permissions in NocoDB can exploit prototype pollution in the connection test endpoint, causing all database write operations to fail application-wide until server restart. This affects NocoDB instances running versions prior to 0.301.0.
💻 Affected Systems
- NocoDB
📦 What is this software?
Nocodb by Nocodb
⚠️ Risk & Real-World Impact
Worst Case
Application-wide denial of service where all database write operations fail, requiring server restart to restore functionality.
Likely Case
Temporary service disruption affecting database write operations until administrators restart the server.
If Mitigated
Minimal impact if proper access controls limit org-level-creator permissions to trusted users only.
🎯 Exploit Status
Exploitation requires authenticated access with specific permissions and knowledge of prototype pollution techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.301.0
Vendor Advisory: https://github.com/nocodb/nocodb/security/advisories/GHSA-95ff-46g6-6gw9
Restart Required: Yes
Instructions:
1. Backup your NocoDB instance. 2. Update NocoDB to version 0.301.0 or later using your package manager or deployment method. 3. Restart the NocoDB service.
🔧 Temporary Workarounds
Restrict org-level-creator permissions
allLimit org-level-creator permissions to only essential, trusted users to reduce attack surface.
Monitor /api/v2/meta/connection/test endpoint
allImplement monitoring and alerting for unusual requests to the vulnerable endpoint.
🧯 If You Can't Patch
- Implement strict access controls to limit org-level-creator permissions to minimum necessary users.
- Monitor server logs for failed database write operations and unusual activity on the /api/v2/meta/connection/test endpoint.
🔍 How to Verify
Check if Vulnerable:
Check NocoDB version; if below 0.301.0 and using default configuration, the system is vulnerable.Check Version:
Check NocoDB web interface admin panel or deployment configuration for version number.Verify Fix Applied:
Confirm NocoDB version is 0.301.0 or later and test database write operations function normally.📡 Detection & Monitoring
Log Indicators:
- Multiple failed database write operations
- Unusual requests to /api/v2/meta/connection/test endpoint from org-level-creator users
Network Indicators:
- HTTP POST requests to /api/v2/meta/connection/test with unusual payloads
SIEM Query:
source="nocodb" AND (uri_path="/api/v2/meta/connection/test" OR error_message="database write failed")