CVE-2026-126284
Received Received - Intake

Server-Side Request Forgery in NocoDB

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
NocoDB from 2026.05.2 before 2026.07.0 contains a server-side request forgery vulnerability that allows Editor-role users to fetch internal URLs because data import reused the webhook internal-network exemption. When NC_ALLOW_LOCAL_HOOKS or NC_WEBHOOK_ALLOW_PRIVATE_NETWORK is set, attackers can request internal services via URLs ending in CSV or spreadsheet extensions and read the responses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126284
EUVD
EUVD-2026-125237

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nocodb nocodb From 2026.07.0 (exc)
nocodb nocodb From 2026.05.2 (inc) to 2026.07.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in NocoDB versions 2026.05.2 through 2026.07.0. It allows users with the Editor role to fetch internal URLs by exploiting the data import feature's reuse of webhook internal-network exemptions. When specific settings like NC_ALLOW_LOCAL_HOOKS or NC_WEBHOOK_ALLOW_PRIVATE_NETWORK are enabled, attackers can request internal services using URLs ending in CSV or spreadsheet extensions and read the responses.

Detection Guidance

Check NocoDB versions between 2026.05.2 and 2026.07.0. Monitor for unusual internal URL requests ending in CSV or spreadsheet extensions. Review logs for data import attempts accessing internal services when NC_ALLOW_LOCAL_HOOKS or NC_WEBHOOK_ALLOW_PRIVATE_NETWORK is enabled.

Impact Analysis

An attacker with Editor role privileges could access internal services or sensitive data within your network by tricking the server into making unauthorized requests. This could lead to data leaks, unauthorized access to internal systems, or further exploitation depending on the internal services exposed.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information privacy). Organizations must ensure such vulnerabilities are patched to maintain regulatory compliance and protect user data.

Mitigation Strategies

Upgrade NocoDB to version 2026.07.0 or later. Disable NC_ALLOW_LOCAL_HOOKS and NC_WEBHOOK_ALLOW_PRIVATE_NETWORK if not required. Enable NC_ALLOW_LOCAL_DATA_IMPORT for controlled data import access. Restrict Editor-role permissions to limit data import capabilities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126284. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...