CVE-2026-41640: NocoBase No-Code Platform SQL Injection
A critical SQL injection vulnerability, CVE-2026-41640, has been identified in NocoBase, an AI-powered no-code/low-code platform. According to the National Vulnerability Database, this flaw exists in the queryParentSQL() function within the core database package. The function improperly constructs recursive Common Table Expression (CTE) queries by concatenating nodeIds directly into SQL statements, rather than utilizing parameterized queries.
This design oversight allows an authenticated attacker to inject arbitrary SQL. If an attacker can create a record with a malicious string as its primary key, any subsequent request that triggers recursive eager loading on that collection will execute the injected SQL. The National Vulnerability Database assigns this a CVSS score of 7.5 (High), underscoring its severity. This issue affects NocoBase versions prior to 2.0.39 and is categorized under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
For defenders, the implications are clear: full data compromise, service disruption, or even remote code execution are on the table. An attacker doesn’t need to be a sophisticated threat actor; they just need the ability to create records. This is a classic SQL injection vector, but its presence in a no-code platform means many users might not even be aware of the underlying database interactions, making detection and prevention harder without proper patching.
What This Means For You
- If your organization uses NocoBase, you are directly exposed to CVE-2026-41640. Immediately verify that all NocoBase instances are updated to version 2.0.39 or later to mitigate this SQL injection vulnerability. Prioritize patching, as the attack vector is straightforward for anyone with record creation privileges.
Related ATT&CK Techniques
🛡️ Detection Rules
7 rules · 6 SIEM formats7 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
Web Application Exploitation Attempt — CVE-2026-41640
title: Web Application Exploitation Attempt — CVE-2026-41640
id: scw-2026-05-07-1
status: experimental
level: high
description: |
Detects common exploitation patterns targeting web applications. Review CVE-2026-41640 advisories for specific indicators.
author: SCW Feed Engine (auto-generated)
date: 2026-05-07
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-41640/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- '..'
- 'SELECT'
- 'UNION'
- '<script'
- 'cmd='
- '/etc/passwd'
condition: selection
falsepositives:
- Legitimate activity from CVE-2026-41640
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-41640 | SQLi | NocoBase platform versions prior to 2.0.39 |
| CVE-2026-41640 | SQLi | Vulnerable function: queryParentSQL() in core database package |
| CVE-2026-41640 | SQLi | Vulnerable mechanism: String concatenation of nodeIds in recursive CTE query |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 07, 2026 at 07:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-8063 — Null Pointer Dereference
CVE-2026-8063 — An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the...
WP-Optimize Plugin Flaw Allows Arbitrary File Deletion, RCE via wp-config.php
CVE-2026-7252 — The WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance plugin for WordPress is vulnerable to arbitrary...
CVE-2026-6692: WordPress Slider Revolution RCE Vulnerability
CVE-2026-6692 — The Slider Revolution plugin for WordPress is vulnerable to Arbitrary File Upload in versions 7.0.0 to 7.0.10 via the '_get_media_url' and '_check_file_path' function....