CVE-2026-46551: NocoDB Denial of Service Vulnerability

CVE-2026-46551 Overview

CVE-2026-46551 affects NocoDB, an open-source platform for building databases as spreadsheets. The vulnerability exists in versions prior to 2026.04.4 and resides in the uploadViaURL path of the v1/v2 attachment API. The endpoint fails to enforce the NC_ATTACHMENT_FIELD_SIZE limit against remote content-length headers or response streams. An authenticated user with Editor-level privileges or higher can direct the server to download arbitrarily large files. The result is disk exhaustion and a denial of service condition on the host. The issue is classified under CWE-770 - Allocation of Resources Without Limits or Throttling.

Critical Impact
An authenticated Editor can exhaust server disk space by triggering remote downloads of unbounded size, causing denial of service on the NocoDB instance.

Affected Products

NocoDB versions prior to 2026.04.4
Self-hosted NocoDB deployments exposing the v1 attachment API
Self-hosted NocoDB deployments exposing the v2 attachment API

Discovery Timeline

2026-06-23 - CVE-2026-46551 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-46551

Vulnerability Analysis

The flaw resides in packages/nocodb/src/services/attachments.service.ts within the uploadViaURL handler. NocoDB exposes a configuration variable, NC_ATTACHMENT_FIELD_SIZE, intended to cap attachment sizes. The service performs an HTTP HEAD probe against the user-supplied URL and reads the Content-Length response header. However, the value is never compared against NC_ATTACHMENT_FIELD_SIZE before the download proceeds.

Following the probe, the service invokes storageAdapter.fileCreateByUrl() to perform the actual download. This call does not pass a maxContentLength parameter to the underlying HTTP client. The result is that response streams of any size are written to storage without bounds checking. A malicious Editor can point the API at a remote URL serving a very large file, or a URL that streams data indefinitely. The server consumes disk until the volume fills, blocking writes and degrading service for all tenants on the host.

Root Cause

The root cause is missing input validation against a configured resource limit. Both the pre-flight HEAD probe and the streaming download path omit enforcement of NC_ATTACHMENT_FIELD_SIZE. The storage adapter has no built-in ceiling either, leaving the server fully exposed to caller-controlled payload sizes.

Attack Vector

Exploitation requires authenticated access at the Editor role or higher. The attacker submits a request to the attachment upload-by-URL endpoint specifying an attacker-controlled URL. The remote endpoint either advertises a large Content-Length or returns a continuous stream. The NocoDB server downloads the content until storage capacity is exhausted. Refer to the GitHub Security Advisory GHSA-99vc-2jx2-688p for the maintainer's technical write-up.

Detection Methods for CVE-2026-46551

Indicators of Compromise

Sudden disk space exhaustion on the NocoDB application or attachment storage volume
HTTP requests to /api/v1/db/storage/upload-by-url or /api/v2/storage/upload-by-url with outbound URLs pointing to untrusted hosts
Repeated uploadViaURL invocations from a single authenticated session
Large attachment files appearing in the configured storage backend without corresponding business activity

Detection Strategies

Inspect NocoDB application logs for uploadViaURL calls and correlate with disk utilization spikes
Monitor egress traffic from the NocoDB host for unusually large inbound transfers triggered by application requests
Audit attachment records in the metadata database for entries with abnormal file sizes

Monitoring Recommendations

Configure disk utilization alerts on attachment storage volumes at 75% and 90% thresholds
Log and review Editor-level API activity, focusing on attachment endpoints
Track outbound HTTP connections from NocoDB workers to flag connections to untrusted external hosts

How to Mitigate CVE-2026-46551

Immediate Actions Required

Upgrade NocoDB to version 2026.04.4 or later, which contains the fix
Audit the user base and revoke Editor or higher roles from accounts that do not require attachment upload privileges
Review existing attachments for oversized files that may indicate prior exploitation

Patch Information

The vulnerability is fixed in NocoDB 2026.04.4. The patch enforces NC_ATTACHMENT_FIELD_SIZE against both the HEAD probe Content-Length value and the response stream during fileCreateByUrl(). See the GitHub Security Advisory GHSA-99vc-2jx2-688p for upgrade guidance.

Workarounds

Restrict network egress from the NocoDB server to an allow-list of trusted storage hosts
Place the attachment storage volume on a dedicated mount with a hard quota to prevent host-wide disk exhaustion
Disable or proxy the upload-by-URL endpoint at the reverse proxy layer until the upgrade is applied

bash

# Example: enforce a storage quota on the NocoDB attachments mount
# This contains the blast radius if uploadViaURL is abused before patching
sudo mount -o remount,usrquota,grpquota /var/lib/nocodb/attachments
sudo setquota -u nocodb 5242880 5242880 0 0 /var/lib/nocodb/attachments

# Example: block the upload-by-url endpoint at nginx until patched
# location ~ ^/api/v[12]/.*/upload-by-url$ {
#     return 403;
# }