CVE-2026-46554 Overview
CVE-2026-46554 is a session expiration vulnerability in NocoDB, an open-source platform that transforms databases into spreadsheet-style interfaces. Versions prior to 2026.04.4 fail to invalidate cached authentication entries when API tokens are deleted. The deletion path removes the token database row but does not evict the token-value keyed entry from the authentication cache. The auth middleware continues to accept the deleted token until the cache entry ages out, producing a deletion-to-revocation window of up to three days. The issue is tracked under [CWE-613: Insufficient Session Expiration].
Critical Impact
Deleted API tokens remain valid for up to three days after deletion, undermining token revocation as a security control.
Affected Products
- NocoDB versions prior to 2026.04.4
- NocoDB self-hosted deployments using API token authentication
- NocoDB cloud instances on vulnerable releases
Discovery Timeline
- 2026-06-23 - CVE-2026-46554 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-46554
Vulnerability Analysis
The vulnerability resides in NocoDB's API token lifecycle management. When an administrator deletes an API token, the application removes the corresponding row from the token table in the database. The authentication middleware, however, performs token validation against an in-memory cache keyed by the token value itself.
Because the deletion code path does not call a cache eviction routine for the token-value key, the cache entry persists. Any client presenting the deleted token continues to authenticate successfully until the cache entry naturally expires. The advisory documents this window as lasting up to three days.
This breaks a fundamental security expectation: an explicit revocation action should immediately invalidate credentials. An attacker who obtained a token through phishing, log exposure, or repository leakage retains access even after defenders detect the compromise and revoke the token.
Root Cause
The root cause is missing cache invalidation logic in the API token deletion handler. The deletion operation is not atomic with respect to the authentication cache. Database state and cache state diverge, and the cache becomes the authoritative source for accepted tokens until TTL expiration.
Attack Vector
Exploitation requires an attacker to already possess a valid API token that has subsequently been deleted by an administrator. The attacker continues to issue authenticated HTTP requests against the NocoDB API using the revoked token. The auth middleware consults the cache, finds a matching entry, and authorizes the request. No additional protocol manipulation is needed.
The vulnerability is described in the NocoDB GitHub Security Advisory GHSA-f76x-f9vj-92jv.
Detection Methods for CVE-2026-46554
Indicators of Compromise
- API requests authenticated with token identifiers that no longer exist in the NocoDB token database table.
- Continued data access activity from a token within the 72 hours following its deletion event.
- Audit log entries showing token deletion followed by subsequent successful authentication using the same token value.
Detection Strategies
- Correlate token deletion events in NocoDB audit logs with subsequent API access events keyed to the same token identifier.
- Reconcile the active token table against the set of tokens used to authenticate recent requests; flag any mismatch.
- Alert when API traffic continues from a source after the associated token has been administratively removed.
Monitoring Recommendations
- Forward NocoDB application and access logs to a centralized log analytics platform for correlation and retention.
- Track per-token request volume and source IP addresses to identify anomalous use after deletion.
- Monitor administrative actions on the /api/v1/tokens endpoints and pair each deletion with a 72-hour follow-up review.
How to Mitigate CVE-2026-46554
Immediate Actions Required
- Upgrade NocoDB to version 2026.04.4 or later, which contains the cache invalidation fix.
- Inventory existing API tokens and rotate any tokens suspected of exposure rather than relying on deletion alone.
- Restart the NocoDB service after deleting tokens on vulnerable versions to force-clear the in-memory auth cache.
Patch Information
The vulnerability is fixed in NocoDB 2026.04.4. The patch ensures the API token deletion path evicts the corresponding token-value keyed entry from the authentication cache at the time of deletion. Patch details and references are available in the NocoDB GitHub Security Advisory.
Workarounds
- Restart the NocoDB application process after each token deletion to flush the auth cache and immediately revoke access.
- Reduce the auth cache TTL in deployment configuration to shorten the deletion-to-revocation window.
- Place NocoDB behind a reverse proxy or API gateway that enforces an allowlist of currently valid token identifiers sourced from the database.
# Configuration example: upgrade NocoDB and restart the service
docker pull nocodb/nocodb:2026.04.4
docker stop nocodb && docker rm nocodb
docker run -d --name nocodb -p 8080:8080 nocodb/nocodb:2026.04.4
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
