CVE-2026-46551: NocoDB Denial of Service via Unvalidated Remote File Upload

Technical summary

The uploadViaURL functionality in NocoDB's v1/v2 attachment API fails to enforce the NC_ATTACHMENT_FIELD_SIZE limit against remote content-length headers or during stream processing. In packages/nocodb/src/services/attachments.service.ts, the initial HEAD request reads the content-length header but never validates it against the configured size constraint. The subsequent storageAdapter.fileCreateByUrl() call downloads the file without applying a maxContentLength parameter, allowing an authenticated user to request arbitrarily large payloads and exhaust server disk resources. The fix in version 2026.04.4 adds proper size validation at both the probe and download stages.

Business impact

This denial-of-service vulnerability can render a NocoDB instance inaccessible by consuming all available disk space. For organizations relying on NocoDB for operational workflows, such an attack disrupts data availability and forces emergency recovery or redeployment. The attack requires authenticated access (Editor role or higher), limiting the threat to internal users or compromised accounts, but the operational impact of service downtime is significant. Recovery typically involves manual disk cleanup and potential data restoration.

Affected systems

NocoDB versions prior to 2026.04.4 are vulnerable. The attachment API endpoints (v1 and v2) are the attack surface. Any NocoDB deployment that permits Editor-level or higher access and exposes the attachment upload functionality is at risk. Organizations should verify their NocoDB version against the 2026.04.4 release date (published 2026-06-23) to determine exposure.

Exploitability

The vulnerability requires authentication as an Editor or above, which limits exploitability to trusted users or accounts compromised via credential theft or session hijacking. No user interaction is required once the attacker is authenticated. The technical barrier to exploitation is low—a simple HTTP request with a URL pointing to a large file suffices. While this is not an unauthenticated attack, the ease of weaponization and the direct denial-of-service impact make it practically exploitable in any environment with user-level account compromise.

Remediation

Upgrade NocoDB to version 2026.04.4 or later immediately. This patch enforces NC_ATTACHMENT_FIELD_SIZE validation in the HEAD probe and applies maxContentLength constraints during the download. Organizations unable to upgrade immediately should restrict Editor-level access to trusted personnel only, audit attachment upload activity, and consider implementing network-level download quotas or egress controls to limit disk I/O during uploads.

Patch guidance

Deploy NocoDB 2026.04.4 or later through your standard update process. Verify the upgrade by checking the version in the NocoDB UI (typically visible in settings or admin panel) and reviewing the release notes to confirm the attachment service patch is included. Test file uploads from remote URLs in a non-production environment first to ensure no workflows are disrupted. No configuration changes are required; the fix applies transparently.

Detection guidance

Monitor attachment API endpoints (v1/v2 upload) for requests originating from Editor-level accounts, especially those targeting external URLs. Flag unusually large content-length values in upload requests or HEAD probes. Monitor disk usage spikes coinciding with attachment upload activity. Check server logs for repeated fileCreateByUrl() calls with large payloads or failed downloads that consumed significant I/O. Implement rate limiting on attachment uploads per user/session to reduce attack surface. Alert on disk usage crossing 80% capacity, particularly on NocoDB storage partitions.

Why prioritize this

Although the CVSS score is 6.5 (Medium), this vulnerability poses significant operational risk because authenticated users can unilaterally disable the entire service. The barrier to exploitation is low (one API call with a malicious URL), and recovery is time-consuming. Prioritize this patch in environments where NocoDB is business-critical, especially if user access is broad or if account compromise is a realistic threat model. Organizations with strict access controls limiting Editor roles can defer this patch slightly, but upgrade within 2–4 weeks.

Risk score, explained

The CVSS 6.5 reflects a network-reachable vulnerability (AV:N) with low attack complexity (AC:L) that requires authentication (PR:L) and causes high impact to availability (A:H), with no confidentiality or integrity impact. This scoring is appropriate for a denial-of-service attack that requires legitimate credentials. However, real-world risk is elevated in environments where Editor accounts are numerous, shared, or frequently compromised, and where NocoDB supports production workloads. Organizations with tightly controlled access and non-critical NocoDB instances may assess risk as lower.

Frequently asked questions