Server-Side Request Forgery (SSRF) in NocoDB - CVE-2026-53927
Published: November 11, 2026
Vulnerability identifier: #VU165949
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-53927
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose cloud metadata, credentials, and internal HTTP responses accessible to the NocoDB process.
The vulnerability exists due to permissive extension matching and an incomplete IP blocklist in NocoDB's axiosRequestMake endpoint when validating spreadsheet-fetch URLs, enabling server-side request forgery. A remote user can submit a crafted URL such as http://169.254.169.254/credentials/.xlsx through spreadsheet import with editor permission to retrieve sensitive internal data.
Affected software
NocoDB
How to mitigate CVE-2026-53927
Install security update from vendor's website.
NocoDB - update to 2026.05.1