Key points
- CVE-2026-112306 affects NocoBase versions up to and including 2.2.28.
- The vulnerability allows SQL injection via the @nocobase/plugin-collection-sql plugin.
- Attackers can read password hashes or access files through this flaw.
NocoBase versions up to 2.2.28 contain a high-severity SQL injection vulnerability that requires immediate attention. The flaw resides in the @nocobase/plugin-collection-sql plugin. This issue allows privileged users to bypass validation checks and inject malicious SQL commands into the application database.
In plain English
SQL injection occurs when an application accepts user input as part of a database command without proper filtering. In this case, the `sqlCollection:setFields` action fails to validate input via `checkSQL()`. An attacker with access to the collection-sql snippet can replace a harmless query with dangerous statements. These statements execute when the system reloads data, potentially granting unauthorized access to sensitive database contents.
The background
The National Vulnerability Database records CVE-2026-112306 with a CVSS score of 8.6, classifying it as high severity. The weakness is categorized under CWE-89, which covers SQL injection. The specific impact involves the ability to read `pg_shadow` password hashes or call `pg_read_file`. This allows an attacker to extract user credentials or read arbitrary files from the server hosting the database.
What changes now
Security teams must assess their NocoBase installations immediately to determine if they are running version 2.2.28 or earlier. The source material does not indicate that a patched version is currently available. Until a vendor update is released, organizations should consider restricting access to the affected plugin or removing the collection-sql functionality. Monitoring logs for unusual database activity is also recommended to detect potential exploitation attempts.
Who needs to act first
Teams usually prioritize systems exposed to the internet or containing sensitive data. Check whether your NocoBase instances allow external access to the collection-sql plugin. If a fix is not yet available, reduce exposure by disabling the feature for non-essential users. Test any temporary workloads in a staging environment before applying to production. Back up databases before making configuration changes. Ensure monitoring tools are active to detect anomalous queries.
What to do and how to stay safe: NocoBase
- Verify your NocoBase version and check if it is 2.2.28 or older.
- Disable the @nocobase/plugin-collection-sql plugin if you cannot update immediately.
- Restrict admin access to the sqlCollection:setFields action to trusted personnel only.
- Monitor database logs for unauthorized SQL execution or file read attempts.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-112306?
It is a high-severity SQL injection vulnerability in NocoBase that allows privileged users to bypass validation and execute arbitrary SQL commands.
Which versions of NocoBase are affected?
The vulnerability affects NocoBase versions up to and including 2.2.28, specifically within the @nocobase/plugin-collection-sql plugin.
Can attackers read password hashes?
Yes, attackers holding the collection-sql snippet can replace queries with statements that read pg_shadow password hashes or call pg_read_file.
