IP Spoofing in NocoDB via X-Forwarded-For Headers

Executive Summary

NocoDB before version 2026.08.0 has an IP address spoofing vulnerability caused by Express trust proxy being enabled unconditionally. This allows unauthenticated attackers to forge their source IP by sending X-Forwarded-For headers, which are then recorded in audit and request logs. Attackers can write arbitrary IP addresses to mislead investigations or bypass rate-limiting mechanisms.

Useful 0 Not Useful 0

Detection Guidance

Check NocoDB version with command: npm list nocodb or docker inspect <container> | grep NocoDB. If version is before 2026.08.0, the system is vulnerable. Inspect logs for unusual IP addresses in X-Forwarded-For headers or audit trails that don't match actual client IPs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to falsify their IP address in logs, making it appear as if malicious activity originated from another source. It can mislead security investigations and help attackers bypass IP-based rate limits without authentication. Systems relying on accurate IP logging for security or compliance may be affected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by allowing falsification of audit logs, which are critical for demonstrating adherence to regulations like GDPR and HIPAA. Inaccurate logs may fail audits or investigations, potentially leading to non-compliance penalties or legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NocoDB to version 2026.08.0 or later immediately. If upgrading is not possible, disable Express proxy trust by setting NC_TRUST_PROXY=false in environment variables. Review and sanitize logs to remove falsified IP entries.

Useful 0 Not Useful 0