CVE-2026-24767CWE-918

NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality

Medium · published January 28, 2026

CVSS v3.1
4.9
EPSS
0%
Percentile
12.2
In the wild
Unconfirmed
What it is

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a blind Server-Side Request Forgery (SSRF) vulnerability exists in the `uploadViaURL` functionality due to an unprotected `HEAD` request. While the subsequent file retrieval logic correctly enforces SSRF protections, the initial metadata request executes without validation. This allows limited outbound requests to arbitrary URLs before SSRF controls are applied. Version 0.301.0 contains a patch for the issue.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00223 · 12.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-01-28T20:29Z
EPSS history
Timeline
  • 28 JAN 20:29Z
    NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality
    cvelistv5