{"id":"CVE-2026-126284","kind":"vulnerability","aliases":["CVE-2026-126284"],"related":[],"title":"NocoDB: Editor users can make server fetch internal URLs via import","description":"NocoDB from 2026.05.2 before 2026.07.0 contains a server-side request forgery vulnerability that allows Editor-role users to fetch internal URLs because data import reused the webhook internal-network exemption. When NC_ALLOW_LOCAL_HOOKS or NC_WEBHOOK_ALLOW_PRIVATE_NETWORK is set, attackers can request internal services via URLs ending in CSV or spreadsheet extensions and read the responses.","summary":"NocoDB from 2026.05.2 before 2026.07.0 lets Editor-role users make the server request internal network URLs during data import. When the local hooks or private network webhook settings are enabled, an attacker can read the responses from internal services.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"nocodb","fixed":[],"affected":"","ecosystem":"vendor"},{"via":"cpe","name":"nocodb","fixed":[],"affected":"","ecosystem":"npm"}],"ecosystems":["npm","vendor"],"tags":["data-import","nocodb","other","self-hosted"],"not_affected_if":["default-config","managed-hosting","no-editor-users"],"how_to_check":"- Check the installed NocoDB version and confirm whether it is at or after `2026.07.0`.\n- Check whether `NC_ALLOW_LOCAL_HOOKS` or `NC_WEBHOOK_ALLOW_PRIVATE_NETWORK` is set in the environment.","fix":"- Move NocoDB to `2026.07.0` or later.","status":"open","published_at":"2026-11-13T10:17:31+00:00","first_seen_at":"2026-11-13T10:47:13+00:00","triaged_at":"2026-11-13T10:59:00+00:00","updated_at":"2026-11-13T11:20:09+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-13T10:59:00Z","model":"claude-haiku-5-5","output":{"fix":"- Move NocoDB to `2026.07.0` or later.","reach":"network","title":"NocoDB: Editor users can make server fetch internal URLs via import","impact":"medium","summary":"NocoDB from 2026.05.2 before 2026.07.0 lets Editor-role users make the server request internal network URLs during data import. When the local hooks or private network webhook settings are enabled, an attacker can read the responses from internal services.","audience":"businesses","category":"other","nicknames":[],"who_cares":["nocodb","self-hosted","data-import"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"internal services readable from the NocoDB server via import","analyst_note":"","how_to_check":"- Check the installed NocoDB version and confirm whether it is at or after `2026.07.0`.\n- Check whether `NC_ALLOW_LOCAL_HOOKS` or `NC_WEBHOOK_ALLOW_PRIVATE_NETWORK` is set in the environment.","plain_action":"","product_name":"nocodb","needs_analyst":false,"not_affected_if":["default-config","managed-hosting","no-editor-users"],"who_is_affected":"Self-hosted NocoDB deployments on versions from `2026.05.2` before `2026.07.0` are exposed, and only when one of the two private-network webhook settings is enabled. Instances on default configuration, or those where no users hold Editor role, are harder to reach. Teams using hosted NocoDB can leave this to the vendor.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000757,"input_tokens":4662,"output_tokens":581,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-126284':14A,17A '-2026':13A,16A '2026.05.2':30B,70C '2026.07.0':32B,72C 'allow':82C,103C,109C 'attack':60B,114C 'contain':73C 'csv':123C 'cve':12A,15A 'data':21B,46B,92C 'data-import':20B 'editor':2A,35B,84C 'editor-rol':34B,83C 'enabl':58B 'end':121C 'exempt':100C 'extens':126C 'fetch':7A,88C 'forgeri':79C 'hook':51B,105C 'host':27B 'import':11A,22B,47B,93C 'intern':8A,42B,66B,89C,98C,117C 'internal-network':97C 'let':33B 'local':50B,104C 'make':5A,38B 'nc':102C,107C 'network':43B,54B,99C,111C 'nocodb':1A,18A,19A,23B,28B,68C 'privat':53B,110C 'read':62B,128C 'request':41B,78C,116C 'respons':64B,130C 'reus':94C 'role':36B,85C 'self':26B 'self-host':25B 'server':6A,40B,76C 'server-sid':75C 'servic':67B,118C 'set':56B,113C 'side':77C 'spreadsheet':125C 'url':9A,44B,90C,120C 'user':3A,37B,86C 'via':10A,119C 'vulner':80C 'webhook':55B,96C,108C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted NocoDB deployments on versions from `2026.05.2` before `2026.07.0` are exposed, and only when one of the two private-network webhook settings is enabled. Instances on default configuration, or those where no users hold Editor role, are harder to reach. Teams using hosted NocoDB can leave this to the vendor.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["nocodb"],"ptokens":["nocodb"],"labels":["dataimport","low","nocodb","npm","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126284':14A,17A '-2026':13A,16A 'cve':12A,15A 'editor':2A 'fetch':7A 'import':11A 'intern':8A 'make':5A 'nocodb':1A,18A,19A 'server':6A 'url':9A 'user':3A 'via':10A","search_b":"'2026.05.2':30B '2026.07.0':32B 'attack':60B 'data':21B,46B 'data-import':20B 'editor':35B 'editor-rol':34B 'enabl':58B 'hook':51B 'host':27B 'import':22B,47B 'intern':42B,66B 'let':33B 'local':50B 'make':38B 'network':43B,54B 'nocodb':23B,28B 'privat':53B 'read':62B 'request':41B 'respons':64B 'role':36B 'self':26B 'self-host':25B 'server':40B 'servic':67B 'set':56B 'url':44B 'user':37B 'webhook':55B","search_c":"'2026.05.2':70C '2026.07.0':72C 'allow':82C,103C,109C 'attack':114C 'contain':73C 'csv':123C 'data':92C 'editor':84C 'editor-rol':83C 'end':121C 'exempt':100C 'extens':126C 'fetch':88C 'forgeri':79C 'hook':105C 'import':93C 'intern':89C,98C,117C 'internal-network':97C 'local':104C 'nc':102C,107C 'network':99C,111C 'nocodb':68C 'privat':110C 'read':128C 'request':78C,116C 'respons':130C 'reus':94C 'role':85C 'server':76C 'server-sid':75C 'servic':118C 'set':113C 'side':77C 'spreadsheet':125C 'url':90C,120C 'user':86C 'via':119C 'vulner':80C 'webhook':96C,108C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T10:06:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126284","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126284","severity":null,"published_at":"2026-11-13T10:17:31+00:00","modified_at":"2026-11-13T10:17:31+00:00","first_seen_at":"2026-11-13T10:47:13+00:00","fetched_at":"2026-11-13T10:47:13+00:00","note":null}],"documents":[{"id":144897,"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-6q3f-6mpq-cqgc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T10:06:32+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144898,"url":"https://www.vulncheck.com/advisories/nocodb-2026.05.2-before-2026.07.0-ssrf-via-data-import-url-fetch","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}