Origin validation error in NocoDB - CVE-2026-126268
Published: November 9, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU162866
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126268
CWE-ID: CWE-346
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to falsify source IP addresses in NocoDB audit logs, misleading investigation and attribution.
The vulnerability exists due to unconditional proxy trust in NocoDB's Express server, which accepts caller-supplied X-Forwarded-For headers as client addresses. An unauthenticated remote attacker can submit requests with forged forwarding headers when the instance is directly reachable or its proxy passes those headers unchanged, causing arbitrary IP addresses to be recorded.
Affected software
NocoDB
How to mitigate CVE-2026-126268
Install security update from vendor's website.
NocoDB - update to 2026.08.0