CVE-2026-28399
Published: 02 March 2026
Summary
CVE-2026-28399 is a medium-severity SQL Injection (CWE-89) vulnerability in Nocodb Nocodb. Its CVSS base score is 6.2 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-28399 is a SQL injection vulnerability (CWE-89) affecting NocoDB, an open-source software platform for building databases as spreadsheets. In versions prior to 0.301.3, an authenticated user with the Creator role can inject arbitrary SQL code through the unit parameter of the DATEADD formula. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote exploitation with low complexity and privileges.
An attacker with Creator role access can exploit this flaw over the network without user interaction by crafting a malicious DATEADD formula that executes arbitrary SQL. Successful exploitation enables full control over the underlying database, allowing unauthorized data access, modification, or deletion, as well as potential denial of service, given the high impacts on confidentiality, integrity, and availability.
The NocoDB security advisory (GHSA-45rp-9p97-h852) and release notes for version 0.301.3 confirm the issue has been patched by addressing the improper sanitization in the DATEADD formula's unit parameter. Security practitioners should upgrade to NocoDB 0.301.3 or later and review access controls for Creator roles to mitigate risk.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9214
Vulnerability details
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing NocoDB web app directly enables remote exploitation for initial access (T1190); arbitrary SQL execution on backend DB enables data collection from databases (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation of user-supplied inputs like the DATEADD formula's unit parameter to block arbitrary SQL execution.
Mitigates the vulnerability through timely flaw remediation by patching NocoDB to version 0.301.3 or later, which addresses the improper sanitization.
Limits the impact of exploitation by enforcing least privilege on Creator roles, reducing the scope of unauthorized database access and modifications.