CVE-2026-24767: NocoDB Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality
Summary
CVE-2026-24767: NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality. Affects nocodb versions < 0.301.0. Fixed in 0.301.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NocoDB is an open-source platform that transforms databases into a smart spreadsheet interface, enabling users to manage data easily. It allows users to upload files via URLs, which is a convenient feature for integrating external data sources. However, this functionality has a vulnerability that exposes the application to potential blind Server-Side Request Forgery (SSRF) attacks due to an unprotected HEAD request.
Vulnerability Detail
A blind Server-Side Request Forgery (SSRF) vulnerability exists in the uploadViaURL functionality of NocoDB. This vulnerability arises from an unvalidated HEAD request made to retrieve metadata from a URL provided by the user. The initial request does not undergo any SSRF filtering, allowing attackers to probe internal services and potentially interact with sensitive endpoints. Although the actual file download is protected by SSRF controls, the initial HEAD request can be exploited to perform limited outbound requests to arbitrary URLs, leading to potential information leakage or service probing.
How To Fix
Latest published version: 0.301.3 as of 22 Oct 2026
npm install nocodb@0.301.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.301.0
This is the first release that contains the fix.
npm install nocodb@0.301.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the uploadViaURL functionality with untrusted URLs until the package is updated. Additionally, implement network-level controls to restrict outbound requests from the NocoDB server to limit exposure to internal services.
Conclusion
The CVE-2026-24767 vulnerability in NocoDB presents a moderate risk due to its potential for blind SSRF attacks through unvalidated HEAD requests. Users are advised to update to the patched version 0.301.0 or later to mitigate this risk. Implementing network-level controls and avoiding untrusted URLs can further enhance security.
See every vulnerability recorded for nocodb →
FAQ
SSRF is a vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially leading to unauthorized access or information disclosure.
If your NocoDB installation is using a version prior to 0.301.0, it is susceptible to blind SSRF attacks, which can allow attackers to probe internal services.
The vulnerability allows limited internal service probing and interaction with sensitive endpoints, but it does not enable direct data exfiltration or full internal network compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 4.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
