CVE-2026-24767

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24767", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-26T21:06:47.868Z", "datePublished": "2026-01-28T20:29:29.868Z", "dateUpdated": "2026-01-29T18:01:24.369Z"}, "containers": {"cna": {"title": "NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/nocodb/nocodb/security/advisories/GHSA-xr7v-j379-34v9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-xr7v-j379-34v9"}], "affected": [{"vendor": "nocodb", "product": "nocodb", "versions": [{"version": "< 0.301.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-28T20:29:29.868Z"}, "descriptions": [{"lang": "en", "value": "NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a blind Server-Side Request Forgery (SSRF) vulnerability exists in the `uploadViaURL` functionality due to an unprotected `HEAD` request. While the subsequent file retrieval logic correctly enforces SSRF protections, the initial metadata request executes without validation. This allows limited outbound requests to arbitrary URLs before SSRF controls are applied. Version 0.301.0 contains a patch for the issue."}], "source": {"advisory": "GHSA-xr7v-j379-34v9", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-xr7v-j379-34v9", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-29T16:03:20.393177Z", "id": "CVE-2026-24767", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T18:01:24.369Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24767", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-29T16:03:20.393177Z"}}}], "references": [{"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-xr7v-j379-34v9", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T16:03:22.566Z"}}], "cna": {"title": "NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality", "source": {"advisory": "GHSA-xr7v-j379-34v9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "nocodb", "product": "nocodb", "versions": [{"status": "affected", "version": "< 0.301.0"}]}], "references": [{"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-xr7v-j379-34v9", "name": "https://github.com/nocodb/nocodb/security/advisories/GHSA-xr7v-j379-34v9", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a blind Server-Side Request Forgery (SSRF) vulnerability exists in the `uploadViaURL` functionality due to an unprotected `HEAD` request. While the subsequent file retrieval logic correctly enforces SSRF protections, the initial metadata request executes without validation. This allows limited outbound requests to arbitrary URLs before SSRF controls are applied. Version 0.301.0 contains a patch for the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-28T20:29:29.868Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24767", "state": "PUBLISHED", "dateUpdated": "2026-01-29T18:01:24.369Z", "dateReserved": "2026-01-26T21:06:47.868Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-28T20:29:29.868Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nocodb", "vendor": "nocodb", "versions": [{"status": "affected", "version": "< 0.301.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E17808E-7686-4232-8ADC-D8C548B7F9F0", "versionEndExcluding": "0.301.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a blind Server-Side Request Forgery (SSRF) vulnerability exists in the `uploadViaURL` functionality due to an unprotected `HEAD` request. While the subsequent file retrieval logic correctly enforces SSRF protections, the initial metadata request executes without validation. This allows limited outbound requests to arbitrary URLs before SSRF controls are applied. Version 0.301.0 contains a patch for the issue."}, {"lang": "es", "value": "NocoDB es un software para construir bases de datos como hojas de c\u00e1lculo. Antes de la versi\u00f3n 0.301.0, existe una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) ciega en la funcionalidad 'uploadViaURL' debido a una petici\u00f3n 'HEAD' desprotegida. Si bien la l\u00f3gica de recuperaci\u00f3n de archivos posterior aplica correctamente las protecciones SSRF, la petici\u00f3n de metadatos inicial se ejecuta sin validaci\u00f3n. Esto permite peticiones salientes limitadas a URLs arbitrarias antes de que se apliquen los controles SSRF. La versi\u00f3n 0.301.0 contiene un parche para el problema."}], "id": "CVE-2026-24767", "lastModified": "2026-06-17T10:23:33.510", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24767", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-29T16:03:20.393177Z", "version": "2.0.3"}}]}, "published": "2026-01-28T21:16:12.270", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-xr7v-j379-34v9"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-xr7v-j379-34v9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T01:39:15.429955+00:00", "value": {"mitigation_remediation": ["Upgrade NocoDB to version 0.301.0 or later", "If an upgrade is not immediately feasible, disable or restrict the uploadViaURL functionality to trusted administrators only", "Configure firewall or host\u2011based network policies to block outbound connections from the NocoDB server to untrusted destinations"], "summary": {"action": "Patch", "impact": "Server\u2011Side Request Forgery"}, "threat_synthesis": {"affected_systems": "The flaw affects the NocoDB application developed by nocodb. All releases before version 0.301.0 are vulnerable. End\u2011users using these versions should consult the NocoDB documentation to apply the update or disable the affected feature.", "description_and_impact": "The vulnerability is an unvalidated HEAD request made by the uploadViaURL endpoint in NocoDB versions prior to 0.301.0. This blind Server\u2011Side Request Forgery allows an attacker to cause the server to send a HEAD request to any URL of the attacker\u2019s choosing before the subsequent download step applies the intended SSRF controls. The attacker can therefore probe or contact arbitrary external services, potentially gathering information or leaking minimal metadata, but cannot directly retrieve data from those services. This weakness is categorized as CWE\u2011918.", "risk_and_exploitability": "The CVSS v3.1 score is 4.9, indicating moderate risk, and the EPSS score is below 1\u202fpercent, suggesting exploitation likelihood is very low. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to be able to invoke the uploadViaURL API endpoint, typically via authenticated or unauthenticated access to the web application, to exploit the unverified request. Because the subsequent download logic enforces SSRF restrictions, the attack surface is limited to non\u2011data\u2011exfiltration probing. Nonetheless, if the system reaches out to sensitive internal resources, the blind SSRF could be leveraged for reconnaissance or to trigger side\u2011effects."}}}}, "created": "2026-01-29T09:09:11.107315+00:00", "updated": "2026-04-18T01:45:33.399778+00:00", "vendors": ["nocodb", "nocodb$PRODUCT$nocodb"]}