Is CVE-2026-46554 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46554 being exploited in the wild.

How severe is CVE-2026-46554?

Medium severity, with a CVSS score of 4, published 23 June 2026.

Which products and versions are affected?

nocodb (npm) <= 0.301.3, SEMVER:introduced=0,last_affected=0.301.3.

Is there a fix for CVE-2026-46554?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-46554 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-46554?

Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46554: NocoDB stale authentication cache after API token deletion

Q: Which products and versions are affected?

nocodb (npm) <= 0.301.3, SEMVER:introduced=0,last_affected=0.301.3.

Q: Is there a fix for CVE-2026-46554?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-46554 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-46554?

Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46554 · Severity: medium · CVSS 4 · Published 2026-06-23

NocoDB, a platform that turns databases into smart spreadsheets, suffered from a flaw where deleted API access tokens remained active for up to three days. This means that even after an administrator revoked a user's or application's access, that token could still be used to view or modify data until the system's internal memory refreshed. This could lead to unauthorized data access during the window between token deletion and actual expiration.

Technologies: nocodb (npm). Vendors: npm.

Quick answers

Is CVE-2026-46554 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46554 being exploited in the wild.
How severe is CVE-2026-46554?: Medium severity, with a CVSS score of 4, published 23 June 2026.
Which products and versions are affected?: nocodb (npm) <= 0.301.3, SEMVER:introduced=0,last_affected=0.301.3.
Is there a fix for CVE-2026-46554?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-46554 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46554?: Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in NocoDB's authentication middleware (CWE-613) resulted in insufficient session expiration for API tokens. While the token deletion process successfully removed the corresponding record from the database, it failed to evict the token-value keyed entry from the authentication cache. Consequently, the middleware continued to validate requests using the deleted token until the cache entry reached its Time-To-Live (TTL) limit, which could be as long as 72 hours. This issue is resolved in version 2026.04.4 by ensuring the cache is properly invalidated upon token deletion.

Affected products

nocodb nocodb < 2026.04.4

Identifiers

CVE-2026-46554
GHSA-f76x-f9vj-92jv

Timeline

2026-05-19: advisory: GitHub Security Advisory published
2026-06-23: disclosed: CVE published to NVD

References

https://github.com/nocodb/nocodb/security/advisories/GHSA-f76x-f9vj-92jv

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.