CVE-2026-24766: NocoDB has Prototype Pollution in Connection Test Endpoint, Leading to DoS

January 28, 2026

An authenticated user with org-level-creator permissions can exploit prototype pollution in the /api/v2/meta/connection/test endpoint, causing all database write operations to fail application-wide until server restart.

While the pollution technically bypasses SUPER_ADMIN authorization checks, no practical privileged actions can be performed because database operations fail immediately after pollution.

References

github.com/advisories/GHSA-95ff-46g6-6gw9
github.com/nocodb/nocodb
github.com/nocodb/nocodb/releases/tag/0.301.0
github.com/nocodb/nocodb/security/advisories/GHSA-95ff-46g6-6gw9
nvd.nist.gov/vuln/detail/CVE-2026-24766

Code Behaviors & Features

Detect and mitigate CVE-2026-24766 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →