CVE-2026-46553: NocoDB Auth Bypass Vulnerability

CVE-2026-46553 Overview

CVE-2026-46553 affects NocoDB, an open-source platform that turns relational databases into smart spreadsheets. The vulnerability exists in the upload-by-URL path, which fails to enforce the NC_ATTACHMENT_FIELD_SIZE configuration value. Authenticated users can bypass the configured per-file size limit by supplying a remote URL or a data: URI. The flaw is classified under [CWE-770] Allocation of Resources Without Limits or Throttling. NocoDB resolved the issue in version 2026.04.1.

Critical Impact
Authenticated users can upload attachments that exceed administrator-defined size limits, leading to potential storage exhaustion and resource abuse.

Affected Products

NocoDB versions prior to 2026.04.1
Self-hosted NocoDB deployments using NC_ATTACHMENT_FIELD_SIZE enforcement
NocoDB instances exposing the upload-by-URL endpoint to authenticated users

Discovery Timeline

2026-06-23 - CVE-2026-46553 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-46553

Vulnerability Analysis

NocoDB supports attaching files to records through direct upload as well as through an upload-by-URL flow. Administrators can configure NC_ATTACHMENT_FIELD_SIZE to cap the maximum bytes accepted per file. The upload-by-URL handler omits this check entirely.

When an authenticated user submits a remote URL, the server fetches the resource without comparing the advertised Content-Length header to the configured limit. The same omission applies to data: URI payloads, where the decoded byte length is never validated. As a result, files of arbitrary size can be ingested through these paths.

The issue maps to [CWE-770] because the application allocates storage and bandwidth without enforcing the documented throttle. The EPSS score is 0.24%, reflecting low expected exploitation activity, and no public proof-of-concept exploit has been catalogued.

Root Cause

The upload-by-URL code path skips the size validation logic applied to multipart file uploads. The handler trusts the requested resource and writes it to attachment storage regardless of the configured field size ceiling.

Attack Vector

Exploitation requires authenticated access to a NocoDB instance with permission to attach files. The attacker submits an attachment field update referencing either a large remote file or a large base64-encoded data: URI. The server retrieves and stores the payload, bypassing NC_ATTACHMENT_FIELD_SIZE. Repeated requests can consume storage, inflate backups, and increase egress costs.

No synthetic exploit code is included. Refer to the GitHub Security Advisory for vendor-confirmed technical details.

Detection Methods for CVE-2026-46553

Indicators of Compromise

Attachment records whose stored byte size exceeds the value of NC_ATTACHMENT_FIELD_SIZE.
Outbound HTTP requests from the NocoDB application server to attacker-controlled hosts triggered by attachment field updates.
Spikes in attachment storage volume or object-store write operations that do not correlate with normal user activity.

Detection Strategies

Audit the attachments table and underlying object store for files larger than the configured per-file limit.
Inspect application logs for upload-by-URL requests and correlate them with the resulting on-disk file size.
Alert on data: URI payloads passed to attachment endpoints, since most legitimate clients submit multipart uploads.

Monitoring Recommendations

Track storage growth per user and per workspace to surface accounts abusing the upload-by-URL flow.
Monitor egress traffic from the NocoDB host to detect retrieval of oversized remote files.
Review authentication logs for low-privilege accounts performing repeated attachment field updates.

How to Mitigate CVE-2026-46553

Immediate Actions Required

Upgrade NocoDB to version 2026.04.1 or later, which contains the fix.
Review existing attachments and remove oversized files that may have been uploaded through the bypass.
Restrict attachment permissions to trusted users until the patch is applied.

Patch Information

NocoDB version 2026.04.1 enforces NC_ATTACHMENT_FIELD_SIZE against both the advertised Content-Length of remote files and the decoded length of data: URIs. Patch details are documented in the NocoDB GitHub Security Advisory GHSA-8rwr-f68v-cvw6.

Workarounds

Place NocoDB behind a reverse proxy that enforces a maximum request body size for attachment endpoints.
Block or rate-limit upload-by-URL requests at the network layer if the feature is not required.
Apply storage quotas at the object-store or filesystem level to contain abuse until the upgrade is complete.

bash

# Example NGINX directive to cap request body size in front of NocoDB
client_max_body_size 20m;