CVE-2026-53931
Received Received - Intake
HTTP Proxy Bypass in NocoDB via CSV Query

Publication date: 2026-06-23

Last updated on: 2026-06-23

Assigner: GitHub, Inc.

Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-import endpoint axiosRequestMake could be used as a generic HTTP proxy. Before the fix it was reachable unauthenticated, and its URL-extension allowlist was a regex tested against the full URL string, so URLs whose query string ended in .csv satisfies the gate even though the underlying request is for another file. This vulnerability is fixed in 2026.05.1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-23
Last Modified
2026-06-23
Generated
2026-06-24
AI Q&A
2026-06-24
EPSS Evaluated
N/A
NVD
CVE-2026-53931
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
nocodb nocodb to 2026.05.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

The vulnerability is fixed in NocoDB version 2026.05.1. The immediate step to mitigate this vulnerability is to upgrade NocoDB to version 2026.05.1 or later.

Executive Summary

The vulnerability in NocoDB prior to version 2026.05.1 involves the spreadsheet-import endpoint called axiosRequestMake, which could be exploited as a generic HTTP proxy.

This endpoint was accessible without authentication, and its URL-extension allowlist was implemented using a regex that tested the full URL string. This allowed URLs with query strings ending in .csv to bypass the restriction, even if the actual requested file was different.

As a result, an attacker could use this endpoint to proxy arbitrary HTTP requests, potentially leading to unauthorized access or misuse.

The issue was fixed in version 2026.05.1.

Impact Analysis

This vulnerability allows unauthenticated attackers to use the spreadsheet-import endpoint as a generic HTTP proxy.

This could lead to unauthorized access to internal or external resources, data leakage, or misuse of the proxy functionality for malicious purposes.

Because the endpoint is unauthenticated, attackers do not need valid credentials to exploit this issue.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53931. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart