CVE-2026-53931
Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-import endpoint axiosRequestMake could be used as a generic HTTP proxy. Before the fix it was reachable unauthenticated, and its URL-extension allowlist was a regex tested against the full URL string, so URLs whose query string ended in .csv satisfies the gate even though the
underlying request is for another file. This vulnerability is fixed in 2026.05.1.
Summary dbcve.org
NocoDB's spreadsheet-import endpoint (axiosRequestMake) was accessible without authentication and could be abused as an HTTP proxy. The vulnerability stemmed from a flawed allowlist regex that only checked if a URL's query string ended in .csv, allowing attackers to proxy requests to arbitrary internal or external URLs by appending ?anything.csv to the request.
Mitigation
Upgrade to NocoDB version 2026.05.1 or later. If immediate patching is not feasible, restrict access to the spreadsheet-import endpoint at the network level or implement additional authentication controls.