GHSA-w43h-r5m5-p832 CVE-2026-47382
NocoDB: Server-Side Request Forgery via Database Connection Host
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.35%
- Chance of exploitation in the next 30 days. Higher than 28.72% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-918 Server-Side Request Forgery (SSRF)
- Fix
2026.05.1- Upgrade nocodb to this version or later
Description
Summary
The connection-test endpoint opened a raw TCP socket to the user-supplied database
host without resolving and range-checking the destination, so private and link-local
addresses (including IPv4-mapped IPv6 forms and localhost) reached the driver.
Details
A new validateDbConnectionHost helper resolves hostnames through DNS, parses each
address with ipaddr.js, normalises IPv4-mapped IPv6, and rejects addresses in the
private, loopback, link-local, unique-local, reserved, unspecified, broadcast, and
carrier-grade-NAT ranges. 0.0.0.0, ::, and the literal localhost are special-cased.
The check runs before the existing SSL block in the connection-test controller and
gates the driver invocation.
Impact
Authenticated users with connection-test permission could probe internal services (Redis, the cloud metadata endpoint, internal databases) reachable from the NocoDB process. A DNS rebinding attacker could still race the resolve-vs-connect window.
Credit
This issue was reported by @helwor-01.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| nocodb | < 2026.05.1 |
2026.05.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
nocodb npm → 2026.05.1
- npm
npm install nocodb@2026.05.1- yarn
yarn add nocodb@2026.05.1- pnpm
pnpm add nocodb@2026.05.1
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- Low
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-918: Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-hmcr-rmjq-47qr NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint | Medium | Also affects nocodb |
| GHSA-h6vv-pcq8-7xm4 NocoDB: Server-Side Request Forgery via Base Migration URL | Medium | Also affects nocodb |
| GHSA-6mhr-74x2-98v9 NocoDB: Stored Cross-Site Scripting via Secure Attachment | Medium | Also affects nocodb |
| GHSA-r989-7g3j-wjhw NocoDB: Refresh Tokens Persist Through Password Recovery | Medium | Also affects nocodb |
| GHSA-gprh-27j3-g5h4 NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL | Medium | Also affects nocodb |
| GHSA-g72g-r7m4-9x4g NocoDB: OAuth Tokens Persist Through Security Events | Medium | Also affects nocodb |
| GHSA-xxpj-q764-9r6q NocoDB: Missing Ownership Check in MCP Attachment Read | Low | Also affects nocodb |
| GHSA-hj85-ph9q-78jg NocoDB: Stored Cross-Site Scripting via Form View Redirect URL | High | Also affects nocodb |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor