CVE-2026-24766 NocoDB Vulnerable to Prototype Pollution in Connection Test Endpoint, Leading to DoS

Medium 4.9 Published 28 Jan 2026 Updated 29 Jan 2026

Authenticated users can cause application-wide denial of service via prototype pollution in the connection test endpoint.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-24766?

CVE-2026-24766 is a medium-severity vulnerability in nocodb, published on 28 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an authenticated user with org-level-creator permissions can exploit prototype pollution in the `/api/v2/meta/connection/test` endpoint, causing all database write operations to fail application-wide until server restart. While the pollution technically bypasses SUPER_ADMIN authorization checks, no practical privileged actions can be performed because database operations fail immediately after pollution. Version 0.301.0 patches the issue.

Weakness: CWE-1321

Which versions are affected by CVE-2026-24766?

2 open source packages ship an affected version, including nocodb. It affects 1 product.

Package	Affected	Fixed in
`nocodb` npm	All versions	`0.301.0`
`nocodb` npm	All versions	`0.301.0`

Products include Nocodb Nocodb.

How do I fix CVE-2026-24766?

Upgrade nocodb to 0.301.0 or later.

Is CVE-2026-24766 being exploited?

There is no known exploitation of CVE-2026-24766 in the wild and no public exploit code.

Sources

Also known as GHSA-95ff-46g6-6gw9.