CVE-2026-47384: NocoDB SQL Injection Vulnerability

CVE-2026-47384 Overview

CVE-2026-47384 is a SQL injection vulnerability in NocoDB, an open-source platform for building databases as spreadsheets. The flaw affects all releases prior to version 2026.05.1. An authenticated user holding column-create permission can inject SQL fragments into the bulk groupBy endpoint by setting a column's title field to malicious SQL. The vulnerability is tracked under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
An authenticated attacker with column-create rights can execute arbitrary SQL against the underlying database through the bulk groupBy endpoint, exposing or modifying data accessible to the NocoDB service account.

Affected Products

NocoDB versions prior to 2026.05.1
Self-hosted NocoDB instances exposing the bulk groupBy API
NocoDB deployments with multi-user collaboration enabled

Discovery Timeline

2026-06-23 - CVE-2026-47384 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-47384

Vulnerability Analysis

The vulnerability resides in NocoDB's bulk groupBy request path. The handler in group-by.ts constructs three database-specific aggregation queries using knex.raw(). The request's column_name value is interpolated directly into the resulting SQL string without parameterization or escaping.

A public endpoint allowlist normally restricts which columns can be referenced. However, the column lookup logic in data-table.service.ts matches incoming identifiers against both the sanitized column_name field and the free-text title field. Because title is user-controlled and not constrained to a strict identifier grammar, an attacker can store SQL syntax in it. When the bulk groupBy code path resolves the column by title, the SQL fragment reaches the raw query builder and executes against the backend database.

Root Cause

The root cause is unsafe string interpolation of user-controlled identifiers into knex.raw() calls combined with an inconsistent identifier-resolution policy. The allowlist enforced at the API boundary applies only to column_name, while internal lookup falls back to the free-text title field that accepts arbitrary characters.

Attack Vector

An attacker requires an authenticated NocoDB session with permission to create or rename columns. The attacker creates or updates a column, placing a SQL fragment in the title attribute. They then issue a bulk groupBy request that references the crafted title. The server's aggregation builder interpolates the malicious title into a raw SQL string, and the database executes the injected statement.

The vulnerability is described in the GitHub Security Advisory GHSA-p8wx-5f39-w3x4. No public proof-of-concept exploit is currently listed in CISA KEV or ExploitDB.

Detection Methods for CVE-2026-47384

Indicators of Compromise

Column title values containing SQL keywords such as SELECT, UNION, --, or function calls rather than human-readable labels.
Application logs showing requests to bulk groupBy endpoints with abnormal column_name or title parameters.
Database server logs revealing unexpected aggregation queries or syntax errors originating from the NocoDB service account.
Sudden creation or renaming of columns by accounts that normally do not perform schema operations.

Detection Strategies

Inspect the NocoDB metadata tables for columns whose title contains characters outside an expected identifier set, such as quotes, parentheses, or semicolons.
Enable verbose query logging on the backend database and alert on aggregation statements that include unexpected subqueries.
Correlate column-create or column-update API calls with subsequent bulk groupBy requests from the same session.

Monitoring Recommendations

Forward NocoDB application logs and database audit logs to a centralized analytics platform for cross-source correlation.
Establish a baseline of legitimate groupBy traffic and alert on parameter values that deviate from that baseline.
Monitor for privilege changes that grant column-create rights to lower-trust accounts.

How to Mitigate CVE-2026-47384

Immediate Actions Required

Upgrade NocoDB to version 2026.05.1 or later, which contains the official fix.
Audit existing columns for title values containing SQL syntax and rename them to safe labels.
Review the list of users holding column-create permission and revoke access where it is not required.

Patch Information

The vulnerability is fixed in NocoDB 2026.05.1. Refer to the NocoDB Security Advisory GHSA-p8wx-5f39-w3x4 for the official patch notes and remediation guidance.

Workarounds

Restrict column-create permission to administrators until the upgrade is applied.
Place a web application firewall in front of NocoDB and block requests to bulk groupBy endpoints containing SQL metacharacters.
Run NocoDB with a database account scoped to the minimum privileges required so that injected queries cannot escalate impact.

bash

# Upgrade NocoDB using Docker
docker pull nocodb/nocodb:2026.05.1
docker stop nocodb && docker rm nocodb
docker run -d --name nocodb -p 8080:8080 nocodb/nocodb:2026.05.1