Server-Side Request Forgery in NocoDB by NocoDB Inc.
CVE-2026-126284

2.3LOW

Key Information:

Vendor

Nocodb

Status
Nocodb
Vendor
CVE Published:
13 November 2026

What is CVE-2026-126284?

NocoDB versions prior to 2026.07.0 are affected by a server-side request forgery vulnerability that allows users with Editor roles to perform unauthorized requests to internal URLs. This issue arises from data import functionality that improperly reuses webhook internal-network exemptions. When the configurations NC_ALLOW_LOCAL_HOOKS or NC_WEBHOOK_ALLOW_PRIVATE_NETWORK are enabled, an attacker could exploit this flaw by sending requests to internal services via URLs that end with CSV or spreadsheet formats, capturing sensitive data in response.

Affected Version(s)

nocodb 2026.05.2 < 2026.07.0

nocodb 2026.07.0

References

https://github.com/nocodb/nocodb/security/advisories/GHSA...
vendor-advisory
https://www.vulncheck.com/advisories/nocodb-2026.05.2-bef...
third-party-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.