PT-2026-42674 · Git+2 · Nocodb
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
NocoDB versions prior to 2026.04.1
Description
The request-filtering-agent Server-Side Request Forgery (SSRF) protection is non-functional in the Slack, Discord, Mattermost, and Teams notification webhook plugins. This occurs because the
httpAgent and httpsAgent variables were incorrectly passed within the request body instead of the axios configuration. An authenticated user with hook-creation permissions (Editor+) can direct outbound POST requests to arbitrary internal hosts, including cloud-metadata endpoints such as 169.254.169.254 and other internal services. If verbose hook logging is enabled via NC AUTOMATION LOG LEVEL=ALL, response bodies may be exfiltrated. The issue resides in the sendMessage() function called by WebhookInvoker.invoke(), where the axios.post() method receives the agents in the second argument (data) rather than the third (config).Recommendations
Update to version 2026.04.1.
Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nocodb