CVE-2026-53931: NocoDB SSRF Vulnerability

CVE-2026-53931 Overview

NocoDB is an open-source platform for building databases as spreadsheets. CVE-2026-53931 affects versions prior to 2026.05.1 and exposes the axiosRequestMake spreadsheet-import endpoint as an unauthenticated generic HTTP proxy. The endpoint enforces an extension allowlist using a regex evaluated against the full URL string. Attackers can append .csv to the query string while requesting a different resource, bypassing the allowlist gate. The flaw is categorized under CWE-441: Unintended Proxy or Intermediary, commonly known as Server-Side Request Forgery (SSRF). The issue is fixed in version 2026.05.1.

Critical Impact
Unauthenticated attackers can coerce NocoDB instances into proxying arbitrary HTTP requests, enabling internal network reconnaissance and access to restricted endpoints.

Affected Products

NocoDB versions prior to 2026.05.1
Self-hosted NocoDB deployments exposing the spreadsheet-import endpoint
Cloud or container-based NocoDB installations without network egress restrictions

Discovery Timeline

2026-06-23 - CVE-2026-53931 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53931

Vulnerability Analysis

The vulnerability resides in the NocoDB spreadsheet-import handler axiosRequestMake. This endpoint accepts a URL parameter and performs an outbound HTTP request to retrieve spreadsheet data. Before the fix, two design weaknesses combined to create an exploitable SSRF condition.

First, the endpoint was reachable without authentication. Any network-adjacent attacker could invoke it. Second, the file-extension allowlist used a regular expression matched against the entire URL string. The regex did not anchor the extension check to the URL path. An attacker could append ?fake=value.csv to any URL and satisfy the gate while the underlying request targets a different resource.

The combined effect transforms NocoDB into an open HTTP proxy. Attackers can reach internal services, cloud metadata endpoints, and other network resources reachable from the NocoDB host.

Root Cause

The root cause is improper input validation on the URL parameter. The allowlist regex was applied to the full URL rather than the resource path. Query strings, fragments, and other URL components could contain the expected .csv extension while the actual fetched resource differed. Combined with missing authentication on the endpoint, the validation gap exposed an unintended proxy capability.

Attack Vector

An attacker sends an unauthenticated HTTP request to the NocoDB spreadsheet-import endpoint. The request includes a target URL where the query string terminates in .csv, satisfying the regex. The server fetches the URL via axiosRequestMake and returns the response. Targets include cloud instance metadata services such as http://169.254.169.254/latest/meta-data/?x=.csv, internal admin consoles, and other non-routable services. The vulnerability requires no user interaction or credentials.

No verified proof-of-concept code is published. See the GitHub Security Advisory for additional technical details.

Detection Methods for CVE-2026-53931

Indicators of Compromise

Outbound HTTP requests from NocoDB hosts to internal IP ranges, link-local addresses (169.254.169.254), or loopback interfaces
Access log entries for the spreadsheet-import endpoint containing query strings that terminate in .csv but point at non-spreadsheet hosts
Unauthenticated invocations of axiosRequestMake from unexpected source IPs

Detection Strategies

Inspect NocoDB application logs for spreadsheet-import calls lacking session or authentication context
Correlate NocoDB egress traffic against expected destinations and flag connections to private IP ranges (RFC 1918) or cloud metadata endpoints
Apply web application firewall rules that decode URL parameters and validate the actual resource path extension rather than the full string

Monitoring Recommendations

Enable verbose access logging on NocoDB with source IP, full URL, and authentication state
Forward NocoDB and reverse-proxy logs to a centralized SIEM for query-based hunting
Monitor outbound network flows from NocoDB containers or hosts and alert on connections to sensitive internal services

How to Mitigate CVE-2026-53931

Immediate Actions Required

Upgrade NocoDB to version 2026.05.1 or later, which contains the fix
Restrict network egress from NocoDB hosts to only the destinations required for legitimate spreadsheet imports
Place NocoDB behind an authenticating reverse proxy if it is currently exposed to untrusted networks
Audit historical logs for unauthenticated calls to the spreadsheet-import endpoint and investigate suspicious destinations

Patch Information

The maintainers fixed the issue in NocoDB 2026.05.1. The patch enforces authentication on the spreadsheet-import endpoint and corrects the extension validation to evaluate the URL path rather than the entire URL string. Review the NocoDB GitHub Security Advisory GHSA-hmcr-rmjq-47qr for upgrade notes.

Workarounds

Block external access to the spreadsheet-import endpoint at the reverse proxy or WAF layer until the upgrade is applied
Enforce egress firewall rules that deny outbound traffic from NocoDB to internal subnets, loopback, and cloud metadata addresses
Require authenticated reverse-proxy sessions for all NocoDB routes to neutralize the unauthenticated invocation path

bash

# Example nginx rule to block unauthenticated access to the import endpoint
location ~* /api/.*/axiosRequestMake {
    auth_request /auth-check;
    deny all;
}

# Example iptables rule to block egress to cloud metadata service
iptables -A OUTPUT -m owner --uid-owner nocodb -d 169.254.169.254 -j DROP