PT-2026-47080 · Npm · Nocodb
Published
2026-06-05
·
Updated
2026-06-05
·
CVE-2026-47382
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
Summary
The connection-test endpoint opened a raw TCP socket to the user-supplied database
host without resolving and range-checking the destination, so private and link-local
addresses (including IPv4-mapped IPv6 forms and
localhost) reached the driver.Details
A new
validateDbConnectionHost helper resolves hostnames through DNS, parses each
address with ipaddr.js, normalises IPv4-mapped IPv6, and rejects addresses in the
private, loopback, link-local, unique-local, reserved, unspecified, broadcast, and
carrier-grade-NAT ranges. 0.0.0.0, ::, and the literal localhost are special-cased.
The check runs before the existing SSL block in the connection-test controller and
gates the driver invocation.Impact
Authenticated users with connection-test permission could probe internal services
(Redis, the cloud metadata endpoint, internal databases) reachable from the NocoDB
process. A DNS rebinding attacker could still race the resolve-vs-connect window.
Credit
This issue was reported by @helwor-01.
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nocodb