PT-2026-42680 · Git+2 · Nocodb

Bugbunny-Research · CVE-2026-46554 · Published 2026-05-21 · Updated 2026-06-25

Positive Technologies (AI Summary)

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.04.4

Description Deleted API tokens continue to authenticate requests until their cache entry expires because the authentication cache is not invalidated by the token value during deletion. The deletion process removes the database row but fails to evict the token-value keyed entry from the cache. Consequently, the authentication middleware accepts the deleted token until the cache entry ages out, creating a window of up to three days between deletion and actual revocation. This breaks the security guarantee that token deletion is immediate.

Recommendations Update to version 2026.04.4.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-46554

GHSA-F76X-F9VJ-92JV

Affected Products

Nocodb

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46554.json · Exploit
• https://osv.dev/vulnerability/GHSA-f76x-f9vj-92jv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46554 · Security Note
• https://osv.dev/vulnerability/CVE-2026-46554 · Vendor Advisory
• https://github.com/nocodb/nocodb/security/advisories/GHSA-f76x-f9vj-92jv · Note
• https://github.com/nocodb/nocodb · Note
• https://t.me/cveNotify/173594 · Telegram Post
• https://t.me/cveNotify/173790 · Telegram Post
• https://t.me/cveNotify/175171 · Telegram Post