CVE-2026-47382 NocoDB: Server-Side Request Forgery via Database Connection Host
Attackers can exploit NocoDB's connection-test endpoint to access internal network resources via Server-Side Request Forgery.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47382?
CVE-2026-47382 is a medium-severity server-side request forgery vulnerability in nocodb, published on 23 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the connection-test endpoint opened a raw TCP socket to the user-supplied database host without resolving and range-checking the destination, so private and link-local addresses (including IPv4-mapped IPv6 forms and localhost) reached the driver. This vulnerability is fixed in 2026.05.1.
Weakness: CWE-918
Which versions are affected by CVE-2026-47382?
2 open source packages ship an affected version, including nocodb.
| Package | Affected | Fixed in |
|---|---|---|
nocodb npm | All versions | 2026.05.1 |
nocodb npm | All versions | 2026.05.1 |
How do I fix CVE-2026-47382?
Upgrade nocodb to 2026.05.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-47382 being exploited?
There is no known exploitation of CVE-2026-47382 in the wild and no public exploit code.
Sources
Also known as GHSA-w43h-r5m5-p832.