{"id":"CVE-2026-126268","kind":"vulnerability","aliases":["CVE-2026-126268"],"related":[],"title":"NocoDB: forged X-Forwarded-For headers spoof logged IPs and evade rate limits","description":"NocoDB before 2026.08.0 contains an IP address spoofing vulnerability that allows unauthenticated attackers to forge their recorded source IP by supplying X-Forwarded-For headers, because Express trust proxy is enabled unconditionally. Attackers can write arbitrary source addresses into audit and request logs to mislead investigations and evade the per-address public API rate limiter.","summary":"NocoDB before 2026.08.0 trusts X-Forwarded-For headers unconditionally because Express trust proxy is always on. An unauthenticated attacker can write any source address into audit and request logs and bypass the per-address public API rate limiter.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NocoDB","fixed":[],"affected":"","ecosystem":"vendor"},{"via":"cpe","name":"nocodb","fixed":[],"affected":"","ecosystem":"npm"}],"ecosystems":["npm","vendor"],"tags":["audit-logging","nocodb","package","self-hosted"],"not_affected_if":["version-2026.08.0-or-later"],"how_to_check":"- Check the installed NocoDB version; anything below `2026.08.0` is affected.\n- Look for a reverse proxy in front of NocoDB that sets X-Forwarded-For; the sources do not say whether this changes exposure.","fix":"- NocoDB: move to `2026.08.0` or later.","status":"open","published_at":"2026-11-13T10:17:29+00:00","first_seen_at":"2026-11-13T10:47:12+00:00","triaged_at":"2026-11-13T10:54:52+00:00","updated_at":"2026-11-13T11:20:09+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:54:52Z","model":"claude-haiku-5-5","output":{"fix":"- NocoDB: move to `2026.08.0` or later.","reach":"internet","title":"NocoDB: forged X-Forwarded-For headers spoof logged IPs and evade rate limits","impact":"low","summary":"NocoDB before 2026.08.0 trusts X-Forwarded-For headers unconditionally because Express trust proxy is always on. An unauthenticated attacker can write any source address into audit and request logs and bypass the per-address public API rate limiter.","audience":"businesses","category":"package","nicknames":[],"who_cares":["nocodb","self-hosted","audit-logging"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker forges audit log entries and evades API rate limits","analyst_note":"","how_to_check":"- Check the installed NocoDB version; anything below `2026.08.0` is affected.\n- Look for a reverse proxy in front of NocoDB that sets X-Forwarded-For; the sources do not say whether this changes exposure.","plain_action":"","product_name":"NocoDB","needs_analyst":false,"not_affected_if":["version-2026.08.0-or-later"],"who_is_affected":"NocoDB instances running a version before `2026.08.0` that are reachable over the network. The flaw lets anyone who can send requests forge the source IP recorded in logs and evade the public API rate limiter, so instances not exposed to untrusted clients are at lower risk. The sources do not describe further conditions.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000746,"input_tokens":4629,"output_tokens":566,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126268':17A,20A '-2026':16A,19A '2026.08.0':33B,73C 'address':55B,66B,77C,109C,123C 'allow':81C 'alway':46B 'api':68B,125C 'arbitrari':107C 'attack':50B,83C,104C 'audit':24B,57B,111C 'audit-log':23B 'bypass':62B 'contain':74C 'cve':15A,18A 'enabl':102C 'evad':12A,119C 'express':42B,98C 'forg':2A,85C 'forward':5A,37B,94C 'header':7A,39B,96C 'host':30B 'investig':117C 'ip':10A,76C,89C 'limit':14A,70B,127C 'log':9A,25B,60B,114C 'mislead':116C 'nocodb':1A,21A,22A,26B,31B,71C 'packag':27B 'per':65B,122C 'per-address':64B,121C 'proxi':44B,100C 'public':67B,124C 'rate':13A,69B,126C 'record':87C 'request':59B,113C 'self':29B 'self-host':28B 'sourc':54B,88C,108C 'spoof':8A,78C 'suppli':91C 'trust':34B,43B,99C 'unauthent':49B,82C 'uncondit':40B,103C 'vulner':79C 'write':52B,106C 'x':4A,36B,93C 'x-forwarded-for':3A,35B,92C","nicknames":[],"mitigations":[],"who_affected":"NocoDB instances running a version before `2026.08.0` that are reachable over the network. The flaw lets anyone who can send requests forge the source IP recorded in logs and evade the public API rate limiter, so instances not exposed to untrusted clients are at lower risk. The sources do not describe further conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["nocodb"],"ptokens":["nocodb"],"labels":["auditlogging","medium","nocodb","npm","package","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126268':17A,20A '-2026':16A,19A 'cve':15A,18A 'evad':12A 'forg':2A 'forward':5A 'header':7A 'ip':10A 'limit':14A 'log':9A 'nocodb':1A,21A,22A 'rate':13A 'spoof':8A 'x':4A 'x-forwarded-for':3A","search_b":"'2026.08.0':33B 'address':55B,66B 'alway':46B 'api':68B 'attack':50B 'audit':24B,57B 'audit-log':23B 'bypass':62B 'express':42B 'forward':37B 'header':39B 'host':30B 'limit':70B 'log':25B,60B 'nocodb':26B,31B 'packag':27B 'per':65B 'per-address':64B 'proxi':44B 'public':67B 'rate':69B 'request':59B 'self':29B 'self-host':28B 'sourc':54B 'trust':34B,43B 'unauthent':49B 'uncondit':40B 'write':52B 'x':36B 'x-forwarded-for':35B","search_c":"'2026.08.0':73C 'address':77C,109C,123C 'allow':81C 'api':125C 'arbitrari':107C 'attack':83C,104C 'audit':111C 'contain':74C 'enabl':102C 'evad':119C 'express':98C 'forg':85C 'forward':94C 'header':96C 'investig':117C 'ip':76C,89C 'limit':127C 'log':114C 'mislead':116C 'nocodb':71C 'per':122C 'per-address':121C 'proxi':100C 'public':124C 'rate':126C 'record':87C 'request':113C 'sourc':88C,108C 'spoof':78C 'suppli':91C 'trust':99C 'unauthent':82C 'uncondit':103C 'vulner':79C 'write':106C 'x':93C 'x-forwarded-for':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T10:06:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126268","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126268","severity":null,"published_at":"2026-11-13T10:17:29+00:00","modified_at":"2026-11-13T10:17:29+00:00","first_seen_at":"2026-11-13T10:47:12+00:00","fetched_at":"2026-11-13T10:47:12+00:00","note":null}],"documents":[{"id":144865,"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-2rm5-wf7w-8j57","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T10:06:30+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144866,"url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-ip-address-spoofing-via-unconditional-proxy-trust","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}