CVE-2026-126284: NocoDB 2026.05.2 before 2026.07.0 SSRF via Data Import URL Fetch
NocoDB from 2026.05.2 before 2026.07.0 contains a server-side request forgery vulnerability that allows Editor-role users to fetch internal URLs because data import reused the webhook internal-network exemption. When NCALLOWLOCALHOOKS or NCWEBHOOKALLOWPRIVATENETWORK is set, attackers can request internal services via URLs ending in CSV or spreadsheet extensions and read the responses.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running NocoDB from 2026.05.2 before 2026.07.0 are exposed when NC_ALLOW_LOCAL_HOOKS or NC_WEBHOOK_ALLOW_PRIVATE_NETWORK is set.
What access does an attacker need?
The attacker needs an account with the Editor role. They must be able to supply a data-import URL ending in a CSV or spreadsheet extension.
What can an attacker obtain through exploitation?
An attacker can cause NocoDB to request internal URLs and read the responses from the internal services reached.
How can administrators check whether their configuration is affected?
Verify the NocoDB version and check whether NC_ALLOW_LOCAL_HOOKS or NC_WEBHOOK_ALLOW_PRIVATE_NETWORK is configured. The issue affects versions before 2026.07.0 when either setting is enabled.