NOCODB · CVE-2026-126284 · Other
NO FIX YET · SEE WHAT TO DO
NocoDB from 2026.05.2 before 2026.07.0 lets Editor-role users make the server request internal network URLs during data import. When the local hooks or private network webhook settings are enabled, an attacker can read the responses from internal services.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted NocoDB deployments on versions from 2026.05.2 before 2026.07.0 are exposed, and only when one of the two private-network webhook settings is enabled. Instances on default configuration, or those where no users hold Editor role, are harder to reach. Teams using hosted NocoDB can leave this to the vendor.
Not affected if default-config, managed-hosting, no-editor-users
Who cares data-import, nocodb, self-hosted
2026.07.0.NC_ALLOW_LOCAL_HOOKS or NC_WEBHOOK_ALLOW_PRIVATE_NETWORK is set in the environment.2026.07.0 or later.NocoDB from 2026.05.2 before 2026.07.0 contains a server-side request forgery vulnerability that allows Editor-role users to fetch internal URLs because data import reused the webhook internal-network exemption. When NC_ALLOW_LOCAL_HOOKS or NC_WEBHOOK_ALLOW_PRIVATE_NETWORK is set, attackers can request internal services via URLs ending in CSV or spreadsheet extensions and read the responses.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.