nocodb up to 0.300.x test prototype pollution

Summaryinfo

A vulnerability, which was classified as problematic, was found in nocodb up to 0.300.x. This vulnerability affects unknown code of the file /api/v2/meta/connection/test. Executing a manipulation can lead to prototype pollution. The identification of this vulnerability is CVE-2026-24766. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in nocodb up to 0.300.x. This vulnerability affects some unknown functionality of the file /api/v2/meta/connection/test. The manipulation with an unknown input leads to a prototype pollution vulnerability. The CWE definition for the vulnerability is CWE-1321. The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. As an impact it is known to affect availability. CVE summarizes:

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an authenticated user with org-level-creator permissions can exploit prototype pollution in the `/api/v2/meta/connection/test` endpoint, causing all database write operations to fail application-wide until server restart. While the pollution technically bypasses SUPER_ADMIN authorization checks, no practical privileged actions can be performed because database operations fail immediately after pollution. Version 0.301.0 patches the issue.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-24766 since 01/26/2026. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are needed for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.

Upgrading to version 0.301.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-4872). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• nocodb

Version

• 0.300

Website

• Product: https://github.com/nocodb/nocodb/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion