External risk intelligence

NocoDB Stored Cross-Site Scripting via Table Deletion Dialog

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-126274

NocoDB is a web-based database management platform that is frequently deployed as a web application. While the vulnerability requires authentication as a Creator user and user interaction, the platform itself is often exposed to the internet in self-hosted or managed environments, making it plausibly reachable, though not inherently public-facing by design for every deployment.

Cross-site Scripting

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A stored cross-site scripting vulnerability has been identified in NocoDB, a web-based database management platform. This issue allows authenticated users with Creator privileges to embed malicious scripts within table or column titles. These scripts can execute when another user performs a specific action, potentially leading to the theft of session tokens.

A security flaw allows script injection through titles.
It could impact users deleting external tables.
Confirm relevance and verify exposure to NocoDB.

Attack Path

How an attacker could exploit the issue

An attacker with Creator privileges can inject malicious script into NocoDB's database by embedding markup within column or table titles. When another authenticated user, typically a victim, interacts with the confirmation dialog to delete an external-source table, the embedded script is executed within their browser. This can lead to the theft of sensitive session tokens stored in the browser's local storage.

Requires authenticated Creator access.
Triggered by deleting an external-source table.
Risk of session token theft.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow authenticated Creator users to inject malicious script into NocoDB when embedding markup in column or table titles. When a victim attempts to delete an external-source table, the confirmation dialog renders these titles, potentially executing the script and leading to the theft of session tokens stored in localStorage.

Stored script and session tokens at risk.
Script execution when deleting tables.
Session hijacking via stolen tokens.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners or platform teams are likely responsible for addressing this stored cross-site scripting vulnerability in NocoDB. The first practical step is to identify all NocoDB instances, confirm their exposure and criticality, locate the accountable owners, and then prioritize remediation based on the identified risk and potential impact of session token theft.

Identify and confirm NocoDB instance ownership.
Verify reachability and business criticality.
Plan risk-based remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NocoDB?

NocoDB is a popular open-source platform that turns any relational database into a smart spreadsheet-like interface. It allows teams to organize, view, and collaborate on data without writing complex SQL queries. Developers and business users often use it as a low-code alternative to traditional database management tools, enabling them to create and manage data structures directly through a web browser.

What does CVE-2026-126274 mean?

This CVE describes a Stored Cross-Site Scripting (XSS) vulnerability, classified as CWE-79. It occurs when an application stores untrusted user input—in this case, malicious scripts hidden within table or column titles—and later displays that input to other users. Because the system fails to properly clean or sanitize these titles before showing them, the browser treats the injected text as active code rather than simple data, executing the script unexpectedly.

How is this vulnerability triggered?

An attacker with Creator-level access must first save malicious markup within a table or column name. The script does not execute just by viewing the title; it triggers specifically when a victim opens the deletion confirmation dialog for an external-source table. If the victim is not performing this specific action—such as deleting a different type of table or simply navigating the interface—the stored script remains dormant.

Do I need to worry about this in my environment?

According to Halo Surface Signal, you should prioritize this if your NocoDB instance is reachable via the internet. Because the vulnerability requires an authenticated attacker, the primary risk involves internal users or compromised accounts acting maliciously. Even if not directly public-facing, if multiple users share access to your database management environment, they could inadvertently or intentionally trigger this script against one another.

When should I take action against this?

Your first step is to locate all NocoDB instances within your infrastructure and confirm their current version. Since this issue involves session token theft, you should prioritize identifying which users have Creator-level privileges. Once you have a clear map of your NocoDB assets and their owners, coordinate with your team to plan a version update to resolve the underlying security flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.