---
id: "CVE-2026-126284"
page: "https://infrastack.ai/live/CVE-2026-126284"
kind: "vulnerability"
aliases: ["CVE-2026-126284"]
title: "NocoDB: Editor users can make server fetch internal URLs via import"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "nocodb", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"via": "cpe", "name": "nocodb", "fixed": [], "affected": "", "ecosystem": "npm"}]
ecosystems: ["npm", "vendor"]
tags: ["data-import", "nocodb", "other", "self-hosted"]
not_affected_if: ["default-config", "managed-hosting", "no-editor-users"]
published_at: "2026-11-13T10:17:31+00:00"
first_seen_at: "2026-11-13T10:47:13+00:00"
updated_at: "2026-11-13T11:20:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126284", "first_seen_at": "2026-11-13T10:47:13+00:00"}]
exploit_sources: []
---

# NocoDB: Editor users can make server fetch internal URLs via import

Link for people: https://infrastack.ai/live/CVE-2026-126284 (this .md is for agents)

NocoDB from 2026.05.2 before 2026.07.0 lets Editor-role users make the server request internal network URLs during data import. When the local hooks or private network webhook settings are enabled, an attacker can read the responses from internal services.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:nocodb affected range not listed fixed no fixed version listed
- npm:nocodb affected range not listed fixed no fixed version listed

## How to check

- Check the installed NocoDB version and confirm whether it is at or after `2026.07.0`.
- Check whether `NC_ALLOW_LOCAL_HOOKS` or `NC_WEBHOOK_ALLOW_PRIVATE_NETWORK` is set in the environment.

## Fix

- Move NocoDB to `2026.07.0` or later.

## Timeline

- 2026-11-13T10:47:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126284

## Documents

- [advisory] Vendor advisory: github.com https://github.com/nocodb/nocodb/security/advisories/GHSA-6q3f-6mpq-cqgc
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/nocodb-2026.05.2-before-2026.07.0-ssrf-via-data-import-url-fetch

## From the sources

NocoDB from 2026.05.2 before 2026.07.0 contains a server-side request forgery vulnerability that allows Editor-role users to fetch internal URLs because data import reused the webhook internal-network exemption. When NC_ALLOW_LOCAL_HOOKS or NC_WEBHOOK_ALLOW_PRIVATE_NETWORK is set, attackers can request internal services via URLs ending in CSV or spreadsheet extensions and read the responses.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_