MEDIUM

CVE-2026-53931

2026-06-23 CVSS v4.0
CVSS
6.9

Description

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-import endpoint axiosRequestMake could be used as a generic HTTP proxy. Before the fix it was reachable unauthenticated, and its URL-extension allowlist was a regex tested against the full URL string, so URLs whose query string ended in .csv satisfies the gate even though the
underlying request is for another file. This vulnerability is fixed in 2026.05.1.

Summary dbcve.org

NocoDB's spreadsheet-import endpoint (axiosRequestMake) was accessible without authentication and could be abused as an HTTP proxy. The vulnerability stemmed from a flawed allowlist regex that only checked if a URL's query string ended in .csv, allowing attackers to proxy requests to arbitrary internal or external URLs by appending ?anything.csv to the request.

Mitigation

Upgrade to NocoDB version 2026.05.1 or later. If immediate patching is not feasible, restrict access to the spreadsheet-import endpoint at the network level or implement additional authentication controls.

Weakness (CWE)

CWE-441
CWE-918 Server-Side Request Forgery (SSRF)

EPSS Score

0.41%
Probability of exploitation in next 30 days
34.6th percentile

References

View on dbcve.org
Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.
Back to CVE