CVE-2026-53931
Deferred Deferred - Pending Action

HTTP Proxy Bypass in NocoDB via CSV Query

Publication date: 2026-06-23

Last updated on: 2026-06-24

Assigner: GitHub, Inc.

Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-import endpoint axiosRequestMake could be used as a generic HTTP proxy. Before the fix it was reachable unauthenticated, and its URL-extension allowlist was a regex tested against the full URL string, so URLs whose query string ended in .csv satisfies the gate even though the underlying request is for another file. This vulnerability is fixed in 2026.05.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-23
Last Modified
2026-06-24
Generated
2026-07-14
AI Q&A
2026-06-24
EPSS Evaluated
2026-07-13
NVD
CVE-2026-53931

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nocodb nocodb to 2026.05.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in NocoDB prior to version 2026.05.1 involves the spreadsheet-import endpoint called axiosRequestMake, which could be exploited as a generic HTTP proxy.

This endpoint was accessible without authentication, and its URL-extension allowlist was implemented using a regex that tested the full URL string. This allowed URLs with query strings ending in .csv to bypass the restriction, even if the actual requested file was different.

As a result, an attacker could use this endpoint to proxy arbitrary HTTP requests, potentially leading to unauthorized access or misuse.

The issue was fixed in version 2026.05.1.

Impact Analysis

This vulnerability allows unauthenticated attackers to use the spreadsheet-import endpoint as a generic HTTP proxy.

This could lead to unauthorized access to internal or external resources, data leakage, or misuse of the proxy functionality for malicious purposes.

Because the endpoint is unauthenticated, attackers do not need valid credentials to exploit this issue.

Compliance Impact

The provided information does not specify how CVE-2026-53931 impacts compliance with common standards and regulations such as GDPR or HIPAA.

Detection Guidance

This vulnerability can be detected by monitoring for unauthorized or unusual HTTP requests to the spreadsheet-import endpoint of NocoDB, especially those containing query strings ending with .csv that may be used to bypass URL extension checks.

You can look for signs of Server-Side Request Forgery (SSRF) attempts by checking server logs for requests to the vulnerable endpoint that include suspicious URLs or query parameters.

Suggested commands to detect potential exploitation attempts include:

  • Using grep to find suspicious requests in web server logs: grep -i 'spreadsheet-import' /var/log/nginx/access.log | grep '\.csv'
  • Using curl to test if the endpoint is accessible without authentication: curl -v 'http://<nocodb-server>/spreadsheet-import?url=https://example.com/robots.txt?.csv'
  • Using network monitoring tools like tcpdump or Wireshark to capture outgoing HTTP requests from the NocoDB server that may indicate proxying behavior.
Mitigation Strategies

The vulnerability is fixed in NocoDB version 2026.05.1. The immediate step to mitigate this vulnerability is to upgrade NocoDB to version 2026.05.1 or later.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53931. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart