Executive brief
NocoDB, an open-source platform that turns databases into smart spreadsheets, contained a flaw in its spreadsheet import feature. This vulnerability allowed unauthorized individuals to use the NocoDB server as a proxy to send web requests to other internal or external systems. This could be used to bypass network security controls or probe internal services that are not normally accessible from the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability existed in the NocoDB 'axiosRequestMake' endpoint due to insufficient input validation and lack of authentication. The endpoint's URL-extension allowlist used a regular expression that matched against the entire URL string rather than just the pathname, allowing attackers to bypass the check by appending a permitted extension (like .csv) as a query parameter. Furthermore, the endpoint lacked authentication guards and destination filtering, enabling unauthenticated attackers to proxy requests to arbitrary internal or external IP addresses. The fix, introduced in version 2026.05.1, implements mandatory authentication, restricts extension checks to the URL pathname, and utilizes a request-filtering agent to block access to private and loopback network ranges.
Affected products
- NocoDB NocoDB < 2026.05.1
Timeline
- 2026-06-13: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD