PT-2026-50473 · Nocodb · Nocodb
CVSS v4.0
5.1
Medium
| Vector | AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
NocoDB versions prior to 2026.05.1
Description
The 'spreadsheet-fetch' endpoint, specifically within the
axiosRequestMake() function, improperly validated URLs. It accepted paths containing permitted extensions anywhere in the string and utilized a manual regex blocklist that failed to include the 127.0.0.0/8 and 169.254.0.0/16 IP ranges. This allowed authenticated users with editor permissions to reach the 'cloud-metadata' endpoint and other internal HTTP endpoints via crafted URLs, potentially leading to the exfiltration of credentials on cloud hosts.Recommendations
Update to version 2026.05.1.
Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nocodb