CVE-2026-53927: NocoDB SSRF Vulnerability

CVE-2026-53927 Overview

CVE-2026-53927 is a Server-Side Request Forgery (SSRF) vulnerability in NocoDB, an open-source platform that turns databases into spreadsheets. The flaw exists in the axiosRequestMake spreadsheet-fetch endpoint in versions prior to 2026.05.1. The endpoint accepts URLs whose path contains a permitted file extension anywhere in the string and relies on a hand-rolled regex blocklist. That blocklist omits the 127.0.0.0/8 loopback range and the 169.254.0.0/16 link-local range used by cloud metadata services. Authenticated attackers can craft a URL that bypasses the filter and reaches the cloud-metadata endpoint. The issue is tracked under [CWE-918] and fixed in NocoDB 2026.05.1.

Critical Impact
Authenticated attackers can coerce the NocoDB server into requesting internal cloud-metadata endpoints, potentially exposing instance credentials and sensitive configuration data.

Affected Products

NocoDB versions prior to 2026.05.1
Self-hosted NocoDB deployments running on cloud providers (AWS, Azure, GCP) with reachable Instance Metadata Service (IMDS)
NocoDB instances exposing the axiosRequestMake spreadsheet-fetch endpoint to authenticated users

Discovery Timeline

2026-06-23 - CVE-2026-53927 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53927

Vulnerability Analysis

The vulnerability resides in the axiosRequestMake handler that powers the spreadsheet-fetch feature in NocoDB. The handler performs two checks before issuing an outbound HTTP request. First, it validates that the URL path contains a permitted file extension such as .csv or .xlsx. Second, it applies a regex-based blocklist intended to prevent requests against internal address ranges. Both controls are insufficient. The extension check matches the permitted string anywhere in the URL, allowing attackers to embed it as a query parameter or fragment. The blocklist omits two critical ranges: 127.0.0.0/8 for loopback traffic and 169.254.0.0/16 for link-local addresses. The combination lets an authenticated user submit a URL targeting http://169.254.169.254/latest/meta-data/?x=foo.csv and have the NocoDB server fetch it. On cloud-hosted instances, the response can include IAM role credentials, user-data, and other sensitive metadata.

Root Cause

The root cause is reliance on string-matching heuristics for both allowlisting and blocklisting URL components. Extension validation by substring search ignores URL structure. The hand-rolled regex blocklist is incomplete because it does not enumerate the full set of reserved IPv4 ranges defined by IANA. The handler also performs no DNS resolution check before the request, so attackers can also abuse hostnames that resolve to internal addresses.

Attack Vector

An authenticated user with permission to invoke the spreadsheet-fetch endpoint sends a crafted URL pointing to an internal IP within 127.0.0.0/8 or 169.254.0.0/16. The path or query string carries a permitted extension to satisfy the validator. The NocoDB backend issues an HTTP GET against the target and returns the response body to the caller. On AWS, the request reaches the Instance Metadata Service and can return temporary credentials associated with the host's IAM role. Refer to the GitHub Security Advisory GHSA-gprh-27j3-g5h4 for the maintainer's technical write-up.

Detection Methods for CVE-2026-53927

Indicators of Compromise

Outbound HTTP requests from the NocoDB server process to 169.254.169.254, 127.0.0.1, or any address in 127.0.0.0/8 or 169.254.0.0/16.
Application logs showing calls to axiosRequestMake with URLs whose host component is an internal IP and whose path or query contains a spreadsheet extension.
Unexpected access to cloud IAM role credentials originating from the NocoDB host's instance identity.

Detection Strategies

Inspect NocoDB request logs for axiosRequestMake invocations where the resolved host falls inside reserved IPv4 ranges.
Correlate outbound network telemetry from NocoDB workloads against the IMDS endpoint and loopback addresses.
Monitor cloud provider audit logs (AWS CloudTrail, Azure Activity Log, GCP Audit Logs) for API calls made with the NocoDB host's instance role from unusual source IPs.

Monitoring Recommendations

Enable IMDSv2 on AWS hosts and alert on any IMDSv1 access attempts from NocoDB instances.
Capture egress traffic from container or VM workloads running NocoDB and flag connections to link-local or loopback ranges.
Forward NocoDB application logs to a centralized SIEM and build alerts on spreadsheet-fetch requests targeting non-public destinations.

How to Mitigate CVE-2026-53927

Immediate Actions Required

Upgrade NocoDB to version 2026.05.1 or later on all self-hosted deployments.
Rotate any cloud IAM credentials, API keys, or secrets that were retrievable through the host's metadata service.
Restrict access to the NocoDB admin and spreadsheet-fetch features to trusted users only and review existing user permissions.

Patch Information

The maintainers fixed the vulnerability in NocoDB 2026.05.1. The patch tightens URL parsing in axiosRequestMake and expands the blocked address ranges to include 127.0.0.0/8 and 169.254.0.0/16. See the GitHub Security Advisory GHSA-gprh-27j3-g5h4 for full release details.

Workarounds

Enforce IMDSv2 with a hop limit of 1 on AWS EC2 instances hosting NocoDB to block proxied metadata access.
Apply network egress policies that deny traffic from the NocoDB workload to 169.254.169.254, 127.0.0.0/8, and other internal ranges.
Place NocoDB behind an outbound proxy that validates destination hosts before forwarding requests.

bash

# AWS CLI: enforce IMDSv2 and restrict hop limit on the NocoDB EC2 instance
aws ec2 modify-instance-metadata-options \
    --instance-id i-0123456789abcdef0 \
    --http-tokens required \
    --http-put-response-hop-limit 1 \
    --http-endpoint enabled

# Linux: block egress to IMDS and loopback from the NocoDB container network
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP