CVE-2026-53927: NocoDB Server-Side Request Forgery via Spreadsheet Fetch URL
Summary
CVE-2026-53927: NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL. Affects nocodb versions < 0.301.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NocoDB is an open-source platform that transforms databases into a smart spreadsheet interface, allowing users to manage and manipulate data easily. It supports various database backends and provides features like data visualization, collaboration, and integration with other tools. However, a vulnerability has been identified that exposes the system to Server-Side Request Forgery (SSRF) attacks, which could lead to unauthorized access to sensitive internal resources.
Vulnerability Detail
The vulnerability arises from the spreadsheet-fetch endpoint, which improperly validates URLs. It previously accepted URLs with permitted extensions anywhere in the string and used a flawed regex blocklist that failed to block certain private IP ranges, such as 127.0.0.0/8 and 169.254.0.0/16. This oversight allowed attackers to craft URLs that could access cloud metadata and other internal HTTP endpoints, potentially leading to credential exfiltration and unauthorized data access. The issue affects authenticated users with editor permissions, making it critical for cloud-hosted installations.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the NocoDB application to trusted networks only, thereby minimizing exposure to potential SSRF attacks. Additionally, consider implementing network-level controls to block access to sensitive internal endpoints from the NocoDB server.
Conclusion
In summary, CVE-2026-53927 is a significant vulnerability in NocoDB that allows for SSRF attacks due to improper URL validation. Users are advised to update to the latest version to mitigate the risk and protect sensitive data from unauthorized access.
See every vulnerability recorded for nocodb →
FAQ
CVE-2026-53927 is a vulnerability in NocoDB that allows for Server-Side Request Forgery (SSRF) through improperly validated spreadsheet fetch URLs.
Authenticated users with editor permissions on NocoDB installations are affected, particularly those hosted in cloud environments.
The vulnerability could allow attackers to read sensitive cloud metadata and access internal HTTP endpoints, leading to credential theft and unauthorized data access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
