Is CVE-2026-41641 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41641 being exploited in the wild.

How severe is CVE-2026-41641?

High severity, with a CVSS score of 7.2, published 7 May 2026.

Which products and versions are affected?

@nocobase/plugin-collection-sql (npm) SEMVER:introduced=0,fixed=2.0.39.

Is there a fix for CVE-2026-41641?

Yes. @nocobase/plugin-collection-sql (npm): upgrade to 2.0.39 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41641 attacked?

It is attacked over the network.

Am I affected by CVE-2026-41641?

Check whether you run Nocobase or @nocobase/plugin-collection-sql (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41641: NocoDB plugin-collection-sql SQL validation bypass in update endpoint

CVE-2026-41641 · Severity: high · CVSS 7.2 · Published 2026-05-07

NocoDB's SQL collection plugin allows administrators to create collections backed by SQL queries. A vulnerability in the update endpoint fails to validate SQL statements, allowing an authenticated user with collection management permissions to inject arbitrary SQL—including database file reads and lateral movement commands—after creating a benign collection. This enables exfiltration of sensitive database content and potential privilege escalation.

Technologies: Nocobase. Vendors: NocoBase, npm.

Quick answers

Is CVE-2026-41641 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41641 being exploited in the wild.
How severe is CVE-2026-41641?: High severity, with a CVSS score of 7.2, published 7 May 2026.
Which products and versions are affected?: @nocobase/plugin-collection-sql (npm) SEMVER:introduced=0,fixed=2.0.39.
Is there a fix for CVE-2026-41641?: Yes. @nocobase/plugin-collection-sql (npm): upgrade to 2.0.39 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41641 attacked?: It is attacked over the network.
Am I affected by CVE-2026-41641?: Check whether you run Nocobase or @nocobase/plugin-collection-sql (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@nocobase/plugin-collection-sql (npm): upgrade to 2.0.39 or later
```
npm install @nocobase/plugin-collection-sql@2.0.39
```

Technical details

The vulnerability is a missing input validation (CWE-89 SQL Injection, CWE-284 Improper Access Control) in the `sqlCollection:update` endpoint. The `checkSQL()` function blocks dangerous keywords (pg_read_file, LOAD_FILE, dblink, etc.) and enforces SELECT/WITH-SELECT-only queries on the `collections:create` and `sqlCollection:execute` endpoints, but is entirely absent from the `sqlCollection:update` handler. An attacker with collection management permissions can (1) create a collection with benign SQL that passes validation, then (2) update it with arbitrary SQL that bypasses all keyword and statement-type checks, and (3) query the collection to execute the injected SQL. The attack requires collection management permissions (pm.data-source-manager.collection-sql); the update endpoint is network-accessible. Fix: add the checkSQL() call to the update action (available in patch version 2.0.39+).

Affected products

NocoDB plugin-collection-sql <= 2.0.38

Identifiers

CVE-2026-41641
GHSA-wrwh-c28m-9jjh

Timeline

2026-04-18: disclosed
2026-04-22: patched: Version 2.0.39 includes fix

References

https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.