CVE-2026-47382 Overview
CVE-2026-47382 is a Server-Side Request Forgery (SSRF) vulnerability in NocoDB, an open-source platform that turns databases into spreadsheet-style interfaces. The flaw resides in the connection-test endpoint, which opens a raw TCP socket to a user-supplied database host without resolving and range-checking the destination. As a result, attackers with authenticated access can direct connection attempts to private, link-local, and loopback addresses, including IPv4-mapped IPv6 forms. NocoDB resolved the issue in version 2026.05.1. The vulnerability is classified under CWE-918: Server-Side Request Forgery.
Critical Impact
Authenticated users can probe internal network services and metadata endpoints by abusing the connection-test endpoint to reach otherwise unreachable hosts.
Affected Products
- NocoDB versions prior to 2026.05.1
- Self-hosted NocoDB deployments exposed to authenticated users
- Cloud and container-based NocoDB instances with network access to internal resources
Discovery Timeline
- 2026-06-23 - CVE-2026-47382 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-47382
Vulnerability Analysis
The vulnerability stems from inadequate validation in NocoDB's database connection-test functionality. When a user submits a connection test request, the backend opens a raw TCP socket to the supplied host and port. The code does not resolve the hostname and check whether the resolved address falls within disallowed ranges before initiating the connection.
This allows an authenticated user to specify hosts such as 127.0.0.1, 169.254.169.254, RFC1918 private addresses, or IPv4-mapped IPv6 representations like ::ffff:127.0.0.1. The driver then attempts to establish a connection to those targets, enabling SSRF against internal services. The vulnerability falls under [CWE-918] and is exploitable over the network with low-privileged authenticated access.
Root Cause
The root cause is missing DNS resolution combined with the absence of an allow-list or block-list check on destination addresses. The connection-test endpoint trusts the user-supplied host string and passes it directly to the database driver. Without resolving the hostname and verifying that the resulting IP address is not loopback, link-local, multicast, or private, the application permits arbitrary internal connections.
Attack Vector
An authenticated attacker submits a connection-test request specifying an internal host. The NocoDB backend initiates a TCP connection from its own network position, which often grants access to services blocked from external networks. Targets include cloud instance metadata services, internal databases, administrative APIs, and other infrastructure reachable from the application host. Response timing and error messages may reveal whether targeted services are running.
The vulnerability mechanism is described in the NocoDB GitHub Security Advisory GHSA-w43h-r5m5-p832.
Detection Methods for CVE-2026-47382
Indicators of Compromise
- Connection-test requests targeting loopback addresses (127.0.0.0/8), private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), or link-local addresses (169.254.0.0/16)
- Outbound TCP connections from the NocoDB process to internal hosts not associated with configured data sources
- Repeated connection-test API calls from a single authenticated session enumerating ports or hosts
- Use of IPv4-mapped IPv6 strings such as ::ffff:127.0.0.1 in connection parameters
Detection Strategies
- Inspect NocoDB application logs for connection-test API calls with hostnames resolving to private or loopback ranges
- Monitor egress traffic from the NocoDB host for connections to cloud metadata endpoints such as 169.254.169.254
- Correlate authenticated session activity with unexpected internal connection attempts using network flow data
Monitoring Recommendations
- Enable verbose logging on the NocoDB connection-test endpoint, including resolved destination IPs and user identity
- Forward application and network telemetry to a centralized data lake for correlation across sessions and hosts
- Alert on connection-test requests targeting hosts outside the approved data source inventory
How to Mitigate CVE-2026-47382
Immediate Actions Required
- Upgrade NocoDB to version 2026.05.1 or later, where input is resolved and range-checked before socket creation
- Audit existing user accounts and revoke connection-test privileges from accounts that do not require them
- Review application and proxy logs for prior connection-test calls referencing internal or metadata addresses
- Restrict outbound network access from the NocoDB host to only approved database endpoints
Patch Information
The vulnerability is fixed in NocoDB version 2026.05.1. The patch resolves the user-supplied host to its IP address and rejects destinations falling within loopback, link-local, private, multicast, and IPv4-mapped IPv6 ranges before opening the TCP socket. Patch details are available in the NocoDB Security Advisory GHSA-w43h-r5m5-p832.
Workarounds
- Place NocoDB behind a network egress filter that blocks traffic to private, loopback, and metadata IP ranges
- Block access to cloud metadata endpoints such as 169.254.169.254 at the host firewall or via IMDSv2 enforcement
- Limit connection-test functionality to administrator roles through reverse-proxy access controls until the patch is applied
- Deploy a web application firewall rule to reject connection-test payloads containing private or loopback hostnames
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
