CVE-2026-53931: NocoDB Server-Side Request Forgery via Spreadsheet Import Endpoint
Summary
CVE-2026-53931: NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint. Affects nocodb versions < 0.301.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NocoDB is an open-source platform that transforms databases into smart APIs, allowing users to build applications without extensive coding knowledge. It provides a user-friendly interface for managing data and supports various database backends. However, a vulnerability in its spreadsheet-import endpoint has been identified, which could allow unauthorized users to exploit the system.
Vulnerability Detail
The vulnerability arises from the spreadsheet-import endpoint 'axiosRequestMake', which was previously accessible without authentication. The endpoint's URL-extension allowlist was improperly configured, allowing attackers to manipulate the query string to bypass restrictions. This could lead to Server-Side Request Forgery (SSRF), enabling attackers to make unauthorized HTTP requests to internal services, potentially exposing sensitive data or causing disruptions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict access to the spreadsheet-import endpoint by implementing additional authentication layers or firewall rules to prevent unauthorized access until the package is updated.
Conclusion
The vulnerability CVE-2026-53931 in NocoDB poses a significant risk due to its potential for Server-Side Request Forgery. It is crucial for users to update to the latest version to ensure their systems are secure. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for nocodb →
FAQ
CVE-2026-53931 is a vulnerability in NocoDB that allows unauthorized users to exploit the spreadsheet-import endpoint for Server-Side Request Forgery.
You can check if your application is affected by using Vulert, which monitors vulnerabilities in open-source packages. Visit Vulert Scanner to analyze your package-lock.json.
The risks include unauthorized access to internal services, potential data exposure, and the ability to manipulate requests on behalf of the NocoDB process.
Yes, a patch is available in NocoDB version 0.301.4 and later. It is recommended to update to this version to mitigate the vulnerability.
If immediate updating is not possible, implement additional security measures such as restricting access to the affected endpoint and monitoring for suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
