CVE-2026-41641 NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call
Attackers with collection permissions can bypass SQL validation to execute arbitrary SQL and exfiltrate data via the update endpoint.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41641?
CVE-2026-41641 is a high-severity SQL injection vulnerability in nocobase, published on 7 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() validation function that blocks dangerous SQL keywords (e.g., pg_read_file, LOAD_FILE, dblink) is applied on the collections:create and sqlCollection:execute endpoints but is entirely missing on the sqlCollection:update endpoint. An attacker with collection management permissions can create a SQL collection with benign SQL, then update it with arbitrary SQL that bypasses all validation, and query the collection to execute the injected SQL and exfiltrate data. This issue has been patched in version 2.0.39.
Which versions are affected by CVE-2026-41641?
2 open source packages ship an affected version, including @nocobase/plugin-collection-sql. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@nocobase/plugin-collection-sql npm | All versions | 2.0.39 |
@nocobase/plugin-collection-sql npm | All versions | 2.0.39 |
Products include Nocobase Nocobase.
How do I fix CVE-2026-41641?
Upgrade @nocobase/plugin-collection-sql to 2.0.39 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-41641 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41641 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in nocobase
- CVE-2026-34156 NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node
- CVE-2026-34825 NocoBase Has SQL Injection via template variable substitution in workflow SQL node
- CVE-2026-41640 NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading
- CVE-2026-40346 NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins
Sources
Also known as GHSA-wrwh-c28m-9jjh.