CVE-2026-53927 NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL
Attackers can exploit a flawed URL validation in NocoDB to access internal cloud metadata endpoints via Server-Side Request Forgery.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-53927?
CVE-2026-53927 is a medium-severity server-side request forgery vulnerability in nocodb, published on 23 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-fetch endpoint (axiosRequestMake) accepted URLs whose path contained a permitted extension anywhere in the string, and applied a hand-rolled regex blocklist that omitted 127.0.0.0/8 and 169.254.0.0/16, allowing the cloud-metadata endpoint to be reached with a crafted URL This vulnerability is fixed in 2026.05.1.
Weakness: CWE-918
Which versions are affected by CVE-2026-53927?
2 open source packages ship an affected version, including nocodb.
| Package | Affected | Fixed in |
|---|---|---|
nocodb npm | All versions to 0.301.3 | None |
nocodb npm | All versions to 0.301.3 | None |
How do I fix CVE-2026-53927?
No fix has been published for CVE-2026-53927 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-53927 being exploited?
There is no known exploitation of CVE-2026-53927 in the wild and no public exploit code.
Sources
Also known as GHSA-gprh-27j3-g5h4.