GHSA-2rm5-wf7w-8j57: NocoDB before 2026.08.0 IP Address Spoofing via Unconditional Proxy Trust
NocoDB before 2026.08.0 contains an IP address spoofing vulnerability that allows unauthenticated attackers to forge their recorded source IP by supplying X-Forwarded-For headers, because Express trust proxy is enabled unconditionally. Attackers can write arbitrary source addresses into audit and request logs to mislead investigations and evade the per-address public API rate limiter.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.08.0
Frequently Asked Questions
Which deployments are exposed to this issue?
NocoDB deployments running versions before 2026.08.0 are affected. The vulnerable behavior is unconditional Express proxy trust, so requests that reach the application can supply X-Forwarded-For values.
What does an attacker need to exploit it?
No authentication, privileges, user interaction, or special conditions are required. An attacker only needs network access to send requests to the NocoDB instance with a forged X-Forwarded-For header.
What is the practical impact of successful exploitation?
An attacker can cause arbitrary source IP addresses to be recorded in audit and request logs, which can mislead incident investigations. They can also evade the public API rate limiter when it is applied per source address.
How can I determine whether attempts have already occurred?
Review audit and request logs for source IP values that are inconsistent with known network paths or other request evidence. Because the affected application accepts attacker-supplied X-Forwarded-For values, logged source addresses cannot be treated as reliable attribution data on vulnerable versions.