PT-2026-50477
CVE-2026-53931
·
Published
2026-06-17
·
Updated
2026-06-25
Description by
CVSS 4.0
6.9
MediumMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
NocoDB versions prior to 2026.05.1
Description
The 'spreadsheet-import' endpoint
axiosRequestMake could be used as a generic HTTP proxy. The endpoint was reachable without authentication, and its URL-extension allowlist used a regular expression tested against the full URL string. This allowed attackers to bypass the restriction by appending .csv to the query string, enabling the NocoDB process to issue HTTP requests to arbitrary destinations, including internal services reachable from the host.Recommendations
Update to version 2026.05.1.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾