NOCODB · CVE-2026-126268 · Package
NO FIX YET · SEE WHAT TO DO
NocoDB before 2026.08.0 trusts X-Forwarded-For headers unconditionally because Express trust proxy is always on. An unauthenticated attacker can write any source address into audit and request logs and bypass the per-address public API rate limiter.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
NocoDB instances running a version before 2026.08.0 that are reachable over the network. The flaw lets anyone who can send requests forge the source IP recorded in logs and evade the public API rate limiter, so instances not exposed to untrusted clients are at lower risk. The sources do not describe further conditions.
Not affected if version-2026.08.0-or-later
Who cares audit-logging, nocodb, self-hosted
2026.08.0 is affected.2026.08.0 or later.NocoDB before 2026.08.0 contains an IP address spoofing vulnerability that allows unauthenticated attackers to forge their recorded source IP by supplying X-Forwarded-For headers, because Express trust proxy is enabled unconditionally. Attackers can write arbitrary source addresses into audit and request logs to mislead investigations and evade the per-address public API rate limiter.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.