CVE-2026-53931: NocoDB SSRF in spreadsheet-import endpoint

CVE-2026-53931 · Severity: medium · CVSS 4 · Published 2026-06-23

NocoDB, an open-source platform that turns databases into smart spreadsheets, contained a flaw in its spreadsheet import feature. This vulnerability allowed unauthorized individuals to use the NocoDB server as a proxy to send web requests to other internal or external systems. This could be used to bypass network security controls or probe internal services that are not normally accessible from the internet.

Technologies: nocodb (npm). Vendors: npm.

Quick answers

Is CVE-2026-53931 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53931 being exploited in the wild.
How severe is CVE-2026-53931?
Medium severity, with a CVSS score of 4, published 23 June 2026.
Which products and versions are affected?
nocodb (npm) <= 0.301.3, SEMVER:introduced=0,last_affected=0.301.3.
Is there a fix for CVE-2026-53931?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-53931 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-53931?
Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability existed in the NocoDB 'axiosRequestMake' endpoint due to insufficient input validation and lack of authentication. The endpoint's URL-extension allowlist used a regular expression that matched against the entire URL string rather than just the pathname, allowing attackers to bypass the check by appending a permitted extension (like .csv) as a query parameter. Furthermore, the endpoint lacked authentication guards and destination filtering, enabling unauthenticated attackers to proxy requests to arbitrary internal or external IP addresses. The fix, introduced in version 2026.05.1, implements mandatory authentication, restricts extension checks to the URL pathname, and utilizes a request-filtering agent to block access to private and loopback network ranges.

Affected products

  • NocoDB NocoDB < 2026.05.1

Identifiers

  • CVE-2026-53931
  • GHSA-hmcr-rmjq-47qr

Timeline

  • 2026-06-13: advisory: GitHub Security Advisory published
  • 2026-06-23: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.