CVE-2026-53927

CVE-2026-53927 · NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL

This page contains facts from public vulnerability sources. Check the original advisory before updating.

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-fetch endpoint (axiosRequestMake) accepted URLs whose path contained a permitted extension anywhere in the string, and applied a hand-rolled regex blocklist that omitted 127.0.0.0/8 and 169.254.0.0/16, allowing the cloud-metadata endpoint to be reached with a crafted URL This vulnerability is fixed in 2026.05.1.

CVSS 5.1 · Medium · EPSS 0.4%

Published

2026-06-23T20:05:10.813Z

Updated

2026-06-24T12:38:17.340Z

Stack: node

Check your server →