CVE-2026-47382

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.05.1

Description The 'connection-test' endpoint opens a raw TCP socket to a user-supplied database host without resolving or range-checking the destination. This allows private and link-local addresses, including IPv4-mapped IPv6 forms and localhost, to reach the driver. Authenticated users with connection-test permissions can use this to probe internal services reachable from the NocoDB process, such as Redis, internal databases, or cloud metadata endpoints. A DNS rebinding attacker—a technique where a domain name is changed to point to a different IP address between the time of resolution and the time of connection—could potentially exploit the window between resolution and connection.

Recommendations Update to version 2026.05.1.