# CVE-2026-88403: NocoDB serverRequest Server-Side Request Forgery

Source: https://junglewise.ai/threats/cve-2026-88403-a-server-side-request-forgery-ssrf-in-the-serverrequest-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88403 · Severity: medium · CVSS 6.5 · Published 2026-09-21

NocoDB is a low-code database platform that allows users to build custom applications and workflows. This vulnerability allows authenticated users to craft HTTP requests that reach internal network services, bypassing security checks. An attacker could access internal databases, cloud metadata endpoints, or other sensitive services that should only be accessible within the organization's network.

Technologies: [NocoDB](https://junglewise.ai/threats/technologies/nocodb-nocodb). Vendors: [NocoDB](https://junglewise.ai/threats/vendors/nocodb).

## Quick answers

**Is CVE-2026-88403 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88403 being exploited in the wild.

**How severe is CVE-2026-88403?** Medium severity, with a CVSS score of 6.5, published 21 September 2026.

**Which products and versions are affected?** NocoDB 2.1.21.

**Is there a fix for CVE-2026-88403?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-88403 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-88403?** Check whether you run NocoDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the serverRequest function when the SERVER_REQUEST_WHITELIST environment variable is not configured (the default). The checkUrlAgainstWhitelist() function only logs a warning for requests to private IP addresses but does not block them, allowing authenticated attackers to send arbitrary HTTP requests to internal services via the customRequests:send API or similar features.

## Affected products

- NocoDB NocoDB 2.1.21

## Timeline

- 2026-09-07: disclosed
- 2026-09-21: advisory

## References

- [https://github.com/czx1111/cve/issues/7](https://github.com/czx1111/cve/issues/7)

## Related threats

- [NocoDB missing authentication in OAuth authorize handler](https://junglewise.ai/threats/cve-2026-121736-nocodb-0-300-0-before-2026-08-0-contains-a-missing)
- [NocoDB clickjacking vulnerability in authenticated interface](https://junglewise.ai/threats/cve-2026-119715-nocodb-before-2026-08-0-contains-a-clickjacking-vulnerability)
- [NocoDB resource exhaustion in authentication endpoints](https://junglewise.ai/threats/cve-2026-116120-a-vulnerability-was-determined-in-nocodb-up-to-2026-07-0-this)
- [NocoDB race condition in password-reset flow](https://junglewise.ai/threats/cve-2026-116119-a-vulnerability-was-found-in-nocodb-up-to-2026-08-0-this-affects)