Is CVE-2026-46551 actively exploited?

No active exploitation of CVE-2026-46551 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-46551 be exploited remotely?

Yes. CVE-2026-46551 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-46551?

CVE-2026-46551 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-46551

MEDIUM

CVE-2026-46551

CWE-770Published: June 23, 2026· Updated: Jun 25, 2026

6.5

CVSS v3.1

EPSS:0.24%probability of exploitation in 30 daysPercentile:14.1th

Official Description

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, the uploadViaURL path in the v1/v2 attachment API did not enforce NC_ATTACHMENT_FIELD_SIZE against the remote content-length or against the response stream. An authenticated user (Editor+) could direct the server to download arbitrarily large files, exhausting disk space and causing denial of service. In packages/nocodb/src/services/attachments.service.ts, the HEAD probe read content-length but never compared it to NC_ATTACHMENT_FIELD_SIZE; the subsequent storageAdapter.fileCreateByUrl() performed the download without maxContentLength. This vulnerability is fixed in 2026.04.4.

NVD Source

Technical Analysis

CVE-2026-46551 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 6.5.