CVE-2026-46554: NocoDB API Token Deletion Leads to Stale Authentication
Summary
CVE-2026-46554: NocoDB: Stale Auth Cache After API Token Deletion. Affects nocodb versions < 0.301.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NocoDB is an open-source platform that transforms databases into smart spreadsheets, allowing users to manage data efficiently. It offers features such as API access, user management, and real-time collaboration. However, a vulnerability exists in its API token management, which can lead to security risks if tokens are not properly invalidated upon deletion.
Vulnerability Detail
The vulnerability arises from the failure to invalidate API tokens immediately upon deletion. When an API token is deleted, the corresponding entry in the authentication cache is not removed, allowing the deleted token to continue authenticating requests until the cache entry expires. This creates a window of opportunity for unauthorized access, as tokens can remain valid for up to three days after deletion, undermining the expected security guarantees of immediate revocation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can manually clear the authentication cache after deleting an API token. This can be done by restarting the NocoDB server or implementing a cache eviction strategy in your application to ensure that deleted tokens are not retained in the cache.
Conclusion
The vulnerability CVE-2026-46554 in NocoDB highlights a critical issue with API token management, where deleted tokens can continue to authenticate requests due to stale cache entries. Immediate action is required to update to the patched version or implement workarounds to mitigate potential security risks.
See every vulnerability recorded for nocodb →
FAQ
The impact includes unauthorized access to the system using deleted API tokens, which can lead to data breaches or manipulation.
A deleted token can remain valid for up to three days, depending on the cache's time-to-live (TTL) settings.
Yes, a patch is available in version 0.301.4 of NocoDB. It is recommended to update to this version or later.
If an immediate update is not possible, consider implementing a manual cache eviction strategy or restarting the server after token deletions.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just your package-lock.json file. You can also check your application against known vulnerabilities using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
