GHSA-h6vv-pcq8-7xm4 CVE-2026-53930
NocoDB: Server-Side Request Forgery via Base Migration URL
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.39%
- Chance of exploitation in the next 30 days. Higher than 32.93% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-918 Server-Side Request Forgery (SSRF)
- Fix
- None yet
- No fixed version published
Description
Summary
The base-migration endpoint accepted a caller-supplied URL that the migration worker
dereferenced without enforcing protocol or destination, allowing scheme abuse
(file:, ftp:, etc.) and probing of internal HTTP destinations.
Details
The migrate endpoint is restricted to the workspace owner role by ACL. The remaining
gaps were (a) protocol validation — the controller now parses body.migrationUrl as a
URL and rejects anything whose protocol is not http: or https: — and (b) private
destination filtering — the worker already runs through useAgent(targetUrl) from
request-filtering-agent, which blocks RFC 1918, loopback, and link-local at the
socket layer.
Impact
With the workspace owner role, a malformed URL could be used to coerce the migration worker into reading local files or talking to non-HTTP services; combined with the HTTP-only filter, owner-supplied targets could not reach private ranges.
Credit
This issue was reported by Devel Group Security Research Team through @TREXNEGRO. It was independently reported by @Lihfdgjr and [@bugbunny-research (https://github.com/bugbunny-research).
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| nocodb | <= 0.301.3 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- High
- User interaction
- None
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-918: Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-hmcr-rmjq-47qr NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint | Medium | Also affects nocodb |
| GHSA-6mhr-74x2-98v9 NocoDB: Stored Cross-Site Scripting via Secure Attachment | Medium | Also affects nocodb |
| GHSA-r989-7g3j-wjhw NocoDB: Refresh Tokens Persist Through Password Recovery | Medium | Also affects nocodb |
| GHSA-gprh-27j3-g5h4 NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL | Medium | Also affects nocodb |
| GHSA-g72g-r7m4-9x4g NocoDB: OAuth Tokens Persist Through Security Events | Medium | Also affects nocodb |
| GHSA-xxpj-q764-9r6q NocoDB: Missing Ownership Check in MCP Attachment Read | Low | Also affects nocodb |
| GHSA-hj85-ph9q-78jg NocoDB: Stored Cross-Site Scripting via Form View Redirect URL | High | Also affects nocodb |
| GHSA-8m7c-hf24-5g47 NocoDB: OAuth Authorization Code Race Condition | Medium | Also affects nocodb |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor