CVE-2026-47382
CVE-2026-47382 · NocoDB: Server-Side Request Forgery via Database Connection Host
This page contains facts from public vulnerability sources. Check the original advisory before updating.
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the connection-test endpoint opened a raw TCP socket to the user-supplied database host without resolving and range-checking the destination, so private and link-local addresses (including IPv4-mapped IPv6 forms and localhost) reached the driver. This vulnerability is fixed in 2026.05.1.
CVSS 5.3 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node