{"id":"CVE-2026-126284","summary":"NocoDB 2026.05.2 before 2026.07.0 SSRF via Data Import URL Fetch","details":"NocoDB from 2026.05.2 before 2026.07.0 contains a server-side request forgery vulnerability that allows Editor-role users to fetch internal URLs because data import reused the webhook internal-network exemption. When NC_ALLOW_LOCAL_HOOKS or NC_WEBHOOK_ALLOW_PRIVATE_NETWORK is set, attackers can request internal services via URLs ending in CSV or spreadsheet extensions and read the responses.","aliases":["GHSA-6q3f-6mpq-cqgc"],"modified":"2026-11-15T02:46:03.071736716Z","published":"2026-11-13T09:36:36.525Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126284.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126284.json"},{"type":"ADVISORY","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-6q3f-6mpq-cqgc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126284"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/nocodb-2026.05.2-before-2026.07.0-ssrf-via-data-import-url-fetch"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nocodb/nocodb","events":[{"introduced":"8f35d69deaecf5a4417695c6533849c12fc9cb76"},{"fixed":"08fbe622c540d9248edc5f20c30d7f02bc4aefa7"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"2026.05.2"},{"fixed":"2026.07.0"}]},{"source":"DESCRIPTION","range":[{"introduced":"2026.05.2"},{"fixed":"2026.07.0"}]}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126284.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}