CVE-2026-126268: NocoDB before 2026.08.0 IP Address Spoofing via Unconditional Proxy Trust
NocoDB before 2026.08.0 contains an IP address spoofing vulnerability that allows unauthenticated attackers to forge their recorded source IP by supplying X-Forwarded-For headers, because Express trust proxy is enabled unconditionally. Attackers can write arbitrary source addresses into audit and request logs to mislead investigations and evade the per-address public API rate limiter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NocoDBto a version that resolves this vulnerability.Fixed in 2026.08.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker that can send requests to an affected NocoDB instance can supply forged X-Forwarded-For headers. No user interaction or existing account is required.
What security controls can be bypassed or misled?
An attacker can cause arbitrary source IP addresses to be recorded in audit and request logs, which can mislead incident investigations. The spoofed address can also be used to evade the per-address public API rate limiter.
Are deployments without a reverse proxy affected?
Yes. The issue is caused by Express proxy trust being enabled unconditionally, so clients can provide X-Forwarded-For headers directly.
How can I tell whether an instance is affected?
NocoDB versions before 2026.08.0 are affected. Affected instances may log a client-controlled address from X-Forwarded-For rather than the actual connection source IP.