# CVE-2026-41641: NocoDB plugin-collection-sql SQL validation bypass in update endpoint

Source: https://junglewise.ai/threats/cve-2026-41641-nocodb-plugin-collection-sql-sql-validation-bypass-in-update  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-41641 · Severity: high · CVSS 7.2 · Published 2026-05-07

NocoDB's SQL collection plugin allows administrators to create collections backed by SQL queries. A vulnerability in the update endpoint fails to validate SQL statements, allowing an authenticated user with collection management permissions to inject arbitrary SQL—including database file reads and lateral movement commands—after creating a benign collection. This enables exfiltration of sensitive database content and potential privilege escalation.

Technologies: [Nocobase](https://junglewise.ai/threats/technologies/nocobase). Vendors: [NocoBase](https://junglewise.ai/threats/vendors/nocobase), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-41641 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41641 being exploited in the wild.

**How severe is CVE-2026-41641?** High severity, with a CVSS score of 7.2, published 7 May 2026.

**Which products and versions are affected?** @nocobase/plugin-collection-sql (npm) SEMVER:introduced=0,fixed=2.0.39.

**Is there a fix for CVE-2026-41641?** Yes. @nocobase/plugin-collection-sql (npm): upgrade to 2.0.39 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41641 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-41641?** Check whether you run Nocobase or @nocobase/plugin-collection-sql (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @nocobase/plugin-collection-sql (npm): upgrade to 2.0.39 or later

  ```sh
  npm install @nocobase/plugin-collection-sql@2.0.39
  ```


## Technical details

The vulnerability is a missing input validation (CWE-89 SQL Injection, CWE-284 Improper Access Control) in the `sqlCollection:update` endpoint. The `checkSQL()` function blocks dangerous keywords (pg_read_file, LOAD_FILE, dblink, etc.) and enforces SELECT/WITH-SELECT-only queries on the `collections:create` and `sqlCollection:execute` endpoints, but is entirely absent from the `sqlCollection:update` handler. An attacker with collection management permissions can (1) create a collection with benign SQL that passes validation, then (2) update it with arbitrary SQL that bypasses all keyword and statement-type checks, and (3) query the collection to execute the injected SQL. The attack requires collection management permissions (pm.data-source-manager.collection-sql); the update endpoint is network-accessible. Fix: add the checkSQL() call to the update action (available in patch version 2.0.39+).

## Affected products

- NocoDB plugin-collection-sql <= 2.0.38

## Identifiers

- CVE-2026-41641
- GHSA-wrwh-c28m-9jjh

## Timeline

- 2026-04-18: disclosed
- 2026-04-22: patched: Version 2.0.39 includes fix

## References

- [https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh](https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh)

## Related threats

- [NocoBase server-side request forgery in customRequests:send](https://junglewise.ai/threats/cve-2026-79914-nocobase-is-an-ai-powered-no-code-low-code-platform-for-building)
- [NocoBase SQL injection in checkSQL function](https://junglewise.ai/threats/cve-2026-88402-a-sql-injection-vulnerability-in-the-checksql-function-of)
- [NocoBase cross-site scripting in rich text field renderer](https://junglewise.ai/threats/cve-2026-84701-nocobase-cross-site-scripting-in-rich-text-field-renderer)
- [NocoBase arbitrary file write and local file inclusion leading to remote code execution](https://junglewise.ai/threats/nocobase-arbitrary-file-write-and-local-file-inclusion-leading-to-b8ec6b22)
- [NocoBase sensitive data exposure via SQL blacklist bypass in SQL Collection](https://junglewise.ai/threats/cve-2026-52888-nocobase-sensitive-data-exposure-via-sql-blacklist-bypass-in-sql)