CVE-2026-47377: NocoDB CSRF Vulnerability

CVE-2026-47377 Overview

CVE-2026-47377 is an open redirect vulnerability in NocoDB, an open-source platform for building databases as spreadsheets. The flaw resides in the client-side hashRedirect plugin, which calls window.location.replace() on a path extracted from the URL hash fragment. The plugin only validates that hashPath.startsWith('/') before redirecting. Protocol-relative URLs of the form //attacker.com/... also satisfy this check, allowing attackers to silently redirect visitors to an attacker-controlled origin. The vulnerability is classified under [CWE-601] URL Redirection to Untrusted Site. NocoDB version 2026.04.1 resolves the issue.

Critical Impact
Attackers craft NocoDB links containing protocol-relative URLs in the hash fragment. Victims clicking these links are silently redirected to attacker-controlled domains, enabling phishing and credential theft campaigns that abuse the trust of the NocoDB origin.

Affected Products

NocoDB versions prior to 2026.04.1
Self-hosted and cloud NocoDB deployments exposing the hashRedirect plugin
Any front-end relying on the unpatched client-side hash routing logic

Discovery Timeline

2026-06-23 - CVE-2026-47377 published to the National Vulnerability Database
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-47377

Vulnerability Analysis

The vulnerability lives in the client-side hashRedirect plugin used by NocoDB. The plugin reads the URL hash fragment, extracts a path, and passes it directly to window.location.replace(). The only validation performed is hashPath.startsWith('/'), which checks whether the first character is a forward slash.

This check is insufficient because protocol-relative URLs in the form //attacker.com/path begin with a slash and are accepted as valid input. Browsers interpret protocol-relative URLs as full navigations using the current page protocol. The plugin therefore replaces the document location with the attacker's origin instead of a same-site path.

The attack requires user interaction. A target must click a malicious NocoDB link, which aligns with the UI:A (User Interaction: Active) value in the CVSS vector. No authentication is required to craft or distribute the malicious URL.

Root Cause

The root cause is incomplete input validation in the hashRedirect plugin. Relying on startsWith('/') does not distinguish absolute same-origin paths (/dashboard) from protocol-relative URLs (//attacker.com). Safe redirect handlers must reject inputs that begin with // or \\ and should validate against an allowlist of internal routes.

Attack Vector

An attacker crafts a NocoDB URL containing a hash fragment such as https://victim-nocodb.example.com/#//attacker.com/login. The attacker distributes the link through phishing email, chat, or social media. When a victim opens the link in a browser, the hashRedirect plugin parses the hash, passes the resulting path to window.location.replace(), and the browser navigates to https://attacker.com/login. The attacker-controlled page can mimic the NocoDB login screen to harvest credentials.

No verified exploit code is published. The mechanism is described in the GitHub Security Advisory GHSA-rvp5-9p55-f5rp.

Detection Methods for CVE-2026-47377

Indicators of Compromise

Web server access logs containing NocoDB URLs with hash fragments beginning with #// or #/\\
Browser referrer headers showing navigation from a NocoDB origin to an unrelated external domain immediately after page load
Phishing reports referencing legitimate NocoDB URLs that ultimately load credential-harvesting pages

Detection Strategies

Inspect proxy and DNS telemetry for outbound navigations from NocoDB hostnames to newly registered or low-reputation domains
Search SIEM data for HTTP referrers matching the NocoDB domain followed by redirects to external origins
Monitor email gateway logs for inbound messages containing NocoDB URLs with suspicious hash fragments such as #//

Monitoring Recommendations

Forward NocoDB application and reverse proxy logs into a centralized data lake for retrospective hunting
Alert when users report unexpected login prompts after clicking NocoDB links
Track NocoDB version inventory and flag any instance running a release prior to 2026.04.1

How to Mitigate CVE-2026-47377

Immediate Actions Required

Upgrade all NocoDB instances to version 2026.04.1 or later
Audit all NocoDB URLs distributed in email, chat, and documentation for hash fragments beginning with //
Notify users of the open redirect risk and reinforce phishing awareness training

Patch Information

The vulnerability is fixed in NocoDB 2026.04.1. The patch tightens validation in the hashRedirect plugin so that protocol-relative URLs are rejected before being passed to window.location.replace(). Full details are available in the NocoDB GitHub Security Advisory.

Workarounds

Restrict access to NocoDB behind authenticated reverse proxies that strip or normalize URL fragments where feasible
Deploy a Content Security Policy with a strict frame-ancestors and form-action directive to reduce phishing impact
Block outbound connections from corporate browsers to known phishing infrastructure using DNS or secure web gateway filtering

bash

# Configuration example: upgrade NocoDB Docker deployment to the patched release
docker pull nocodb/nocodb:2026.04.1
docker stop nocodb && docker rm nocodb
docker run -d --name nocodb \
  -p 8080:8080 \
  -v nocodb_data:/usr/app/data \
  nocodb/nocodb:2026.04.1