CVE-2026-126284

Name of the Vulnerable Software and Affected Versions NocoDB versions 2026.05.2 through 2026.06.9

Description A server-side request forgery (SSRF) issue exists where users with the Editor role can fetch internal URLs. This occurs because the data import process reuses the internal-network exemption intended for webhooks. When the NC ALLOW LOCAL HOOKS or NC WEBHOOK ALLOW PRIVATE NETWORK variables are enabled, an attacker can request internal services using URLs that end in CSV or spreadsheet extensions to read the responses.

Recommendations Update NocoDB to version 2026.07.0 or later. Disable the NC ALLOW LOCAL HOOKS and NC WEBHOOK ALLOW PRIVATE NETWORK variables to prevent internal network requests.