Vulnerability · Published Jan 28, 2026 · Assigned by GitHub_M

CVE-2026-24767NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality

Medium 4.9

In plain English

A medium-severity server-side request forgery in nocodb from nocodb. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.9Medium

Exploit odds (30 days)0.2%top 87.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a blind Server-Side Request Forgery (SSRF) vulnerability exists in the `uploadViaURL` functionality due to an unprotected `HEAD` request. While the subsequent file retrieval logic correctly enforces SSRF protections, the initial metadata request executes without validation. This allows limited outbound requests to arbitrary URLs before SSRF controls are applied. Version 0.301.0 contains a patch for the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	nocodb	0.301.0	GHSA-xr7v-j379-34v9

Affected products (as reported)

Vendor	Product	Versions
nocodb	nocodb	< 0.301.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

References

https://github.com/nocodb/nocodb/security/advisories/GHSA-xr7v-j379-34v9 x_refsource_CONFIRM