CVE-2026-53931

NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint

State: Published
Severity: 6.9 Medium
Published: Jun 23, 2026
Updated: Jun 24, 2026
Reserved: Jun 11, 2026

Description

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-import endpoint axiosRequestMake could be used as a generic HTTP proxy. Before the fix it was reachable unauthenticated, and its URL-extension allowlist was a regex tested against the full URL string, so URLs whose query string ended in .csv satisfies the gate even though the underlying request is for another file. This vulnerability is fixed in 2026.05.1.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N	GitHub_M

Weaknesses

CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')
CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
nocodbnocodb	< 2026.05.1Affected

References

https://github.com/nocodb/nocodb/security/advisories/GHSA-hmcr-rmjq-47qr

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.