PT-2026-50477 · Nocodb · Nocodb

P- · CVE-2026-53931 · Published 2026-06-17 · Updated 2026-06-25

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.05.1

Description The 'spreadsheet-import' endpoint axiosRequestMake could be used as a generic HTTP proxy. The endpoint was reachable without authentication, and its URL-extension allowlist used a regular expression tested against the full URL string. This allowed attackers to bypass the restriction by appending .csv to the query string, enabling the NocoDB process to issue HTTP requests to arbitrary destinations, including internal services reachable from the host.

Recommendations Update to version 2026.05.1.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

CWE-441

Related Identifiers

CVE-2026-53931

GHSA-HMCR-RMJQ-47QR

Affected Products

Nocodb

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53931.json · Exploit
• https://osv.dev/vulnerability/GHSA-hmcr-rmjq-47qr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53931 · Security Note
• https://osv.dev/vulnerability/CVE-2026-53931 · Vendor Advisory
• https://github.com/nocodb/nocodb/security/advisories/GHSA-hmcr-rmjq-47qr · Note
• https://github.com/nocodb/nocodb · Note
• https://t.me/cveNotify/174014 · Telegram Post
• https://t.me/cveNotify/175191 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2069571448071434610 · Twitter Post