Unintended Proxy or Intermediary in NocoDB - CVE-2026-53931
Published: November 9, 2026
Vulnerability identifier: #VU162857
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-53931
CWE-ID: CWE-441
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to use NocoDB as an HTTP proxy to reach internal services accessible from its host.
The vulnerability exists due to missing authentication and full-URL extension validation in the spreadsheet import endpoint, which accepts a spreadsheet extension in a URL query string. An unauthenticated remote attacker can append a .csv query suffix to a target URL and cause the server to request a non-spreadsheet resource.
Affected software
NocoDB
How to mitigate CVE-2026-53931
Install security update from vendor's website.
NocoDB - update to 2026.05.1