CVE-2026-24767
📋 TL;DR
NocoDB versions before 0.301.0 contain a blind SSRF vulnerability in the uploadViaURL functionality. The initial HEAD request for metadata lacks SSRF validation, allowing attackers to make limited outbound requests to arbitrary URLs. This affects all NocoDB deployments using vulnerable versions.
💻 Affected Systems
- NocoDB
📦 What is this software?
Nocodb by Nocodb
⚠️ Risk & Real-World Impact
Worst Case
Attacker could probe internal network services, potentially discovering internal infrastructure or conducting limited port scanning through outbound requests.
Likely Case
Limited information disclosure about internal network services or external service interaction through controlled outbound requests.
If Mitigated
Minimal impact as the subsequent file retrieval has proper SSRF controls, limiting the attack to metadata requests only.
🎯 Exploit Status
Exploitation requires access to the uploadViaURL endpoint, which typically requires authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.301.0
Vendor Advisory: https://github.com/nocodb/nocodb/security/advisories/GHSA-xr7v-j379-34v9
Restart Required: Yes
Instructions:
1. Update NocoDB to version 0.301.0 or later. 2. Restart the NocoDB service. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable uploadViaURL functionality
allTemporarily disable the vulnerable uploadViaURL endpoint until patching is possible.
Configure NocoDB to disable URL-based uploads through application settings or environment variables.
🧯 If You Can't Patch
- Restrict network access to NocoDB instances to trusted users only.
- Implement network segmentation to limit outbound connections from NocoDB servers.
🔍 How to Verify
Check if Vulnerable:
Check NocoDB version via web interface or API. If version is below 0.301.0, system is vulnerable.Check Version:
Check NocoDB web interface dashboard or use API endpoint for version information.Verify Fix Applied:
Confirm NocoDB version is 0.301.0 or higher and test uploadViaURL functionality with controlled test cases.📡 Detection & Monitoring
Log Indicators:
- Unusual HEAD requests to external or internal URLs from NocoDB server
- Multiple failed upload attempts via URL
Network Indicators:
- Outbound HTTP HEAD requests from NocoDB server to unusual destinations
- Port scanning patterns from NocoDB server
SIEM Query:
source="nocodb" AND (http_method="HEAD" AND url_contains="http")