CVE-2026-53930: NocoDB Server-Side Request Forgery via Base Migration URL
Summary
CVE-2026-53930: NocoDB: Server-Side Request Forgery via Base Migration URL. Affects nocodb versions < 0.301.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NocoDB is an open-source platform that transforms databases into smart APIs, enabling users to manage and interact with their data through a user-friendly interface. It supports various databases and provides features like data visualization and collaboration. However, a recent vulnerability has been identified that could allow unauthorized access to internal resources.
Vulnerability Detail
The vulnerability arises from the base-migration endpoint, which accepts a caller-supplied URL without enforcing strict protocol validation. This oversight allows attackers with workspace owner privileges to exploit the migration worker, potentially leading to Server-Side Request Forgery (SSRF) attacks. Attackers could coerce the migration worker into accessing local files or communicating with non-HTTP services, posing a risk to sensitive internal resources. The vulnerability is classified under CWE-918, indicating its nature as an SSRF issue.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can restrict access to the migration endpoint to trusted users only, ensuring that only authorized personnel can invoke the migration process. Additionally, implementing network-level controls to block unauthorized access to internal resources can mitigate the risk.
Conclusion
In summary, CVE-2026-53930 is a significant vulnerability in NocoDB that allows SSRF attacks through improperly validated URLs. Users are strongly advised to update to the latest version to mitigate risks associated with this vulnerability. Implementing additional security measures can further protect sensitive resources.
See every vulnerability recorded for nocodb →
FAQ
CVE-2026-53930 is a vulnerability in NocoDB that allows Server-Side Request Forgery (SSRF) through the base migration URL, potentially exposing internal resources.
Any user with workspace owner privileges in NocoDB versions up to 0.301.3 is affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you are affected, update your NocoDB package to version 0.301.4 or later using the command 'npm install nocodb@0.301.4'.
The CVSS score of this vulnerability is 5.1, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
