What is the CVSS score of CVE-2026-46548?

CVE-2026-46548 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-46548?

Yes, a patch is available for CVE-2026-46548. Update the affected software to the latest version immediately.

NocoDB CVE-2026-46548

EUVD-2026-38587 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-21 https://github.com/nocodb/nocodb

GHSA-2c5x-4jgf-88mj

Mattermost SSRF

4.3

CVSS 3.1 · Vendor: https://github.com/nocodb/nocodb

Severity by source

Vendor (https://github.com/nocodb/nocodb) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (https://github.com/nocodb/nocodb) · only source for this CVE.

CVSS VectorVendor: https://github.com/nocodb/nocodb

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 23, 2026 - 23:02 EUVD

Source Code Evidence Fetched

May 21, 2026 - 21:38 vuln.today

Analysis Generated

May 21, 2026 - 21:38 vuln.today

DescriptionCVE.org

Summary

The request-filtering-agent SSRF protection was non-functional in the four notification webhook plugins (Slack, Discord, Mattermost, Teams) because httpAgent / httpsAgent were passed as part of the request body rather than the axios config. An authenticated user with hook-creation permission could direct outbound POST requests to arbitrary internal hosts.

Details

axios.post(url, data, config) expects connection agents in the third (config) argument. In all four plugins, the agents were placed in the second (data) argument and serialised as JSON body content:

// packages/nocodb/src/plugins/slack/Slack.ts (and Discord / Mattermost / Teams - identical pattern)
return await axios.post(webhook_url, {
  text,
  httpAgent: useAgent(webhook_url),   // wrong position - serialised, not used
  httpsAgent: useAgent(webhook_url),
});

The webhook flow: an Editor+ user creates a webhook with notification.payload.channels[].webhook_url pointing to an internal host; on trigger, WebhookInvoker.invoke() calls the plugin's sendMessage() which performs the outbound axios.post with no SSRF filtering applied.

This is distinct from GHSA-xr7v-j379-34v9, which covers a blind SSRF via HEAD in the upload-by-URL path.

Impact

Authenticated user (Editor+) can reach cloud-metadata endpoints (169.254.169.254) and internal services.
Combined with verbose hook logging (NC_AUTOMATION_LOG_LEVEL=ALL), response bodies may be exfiltrated.

Credit

This issue was reported by @ik0z.

AnalysisAI

SSRF protection bypass in NocoDB's notification webhook plugins (Slack, Discord, Mattermost, Teams) allows authenticated Editor-level users to issue outbound POST requests to arbitrary internal hosts, including cloud-metadata endpoints. The root cause is a misplaced axios argument: httpAgent/httpsAgent were serialized into the request body instead of being passed as axios connection config, rendering the request-filtering-agent SSRF guard entirely ineffective across all four plugins. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

NocoDB (pkg:npm/nocodb) uses the request-filtering-agent npm library to prevent SSRF by supplying custom HTTP/HTTPS agents to axios. The axios API signature axios.post(url, data, config) requires connection agents in the third config argument; however, all four webhook plugin implementations (Slack.ts, Discord, Mattermost, Teams) place httpAgent and httpsAgent inside the second data argument, causing them to be JSON-serialized into the POST body and completely ignored by axios. This is a CWE-918 (Server-Side Request Forgery) root cause: the application accepts a user-controlled URL and issues a server-side HTTP request without effective filtering. The affected package version is nocodb <= 0.301.3 per the GitHub advisory GHSA-2c5x-4jgf-88mj. This is distinct from the related GHSA-xr7v-j379-34v9, which covers a separate blind SSRF in the upload-by-URL path.

RemediationAI

No vendor-released patch has been identified at time of analysis - the GitHub advisory (GHSA-2c5x-4jgf-88mj) lists fixed version as None. Until a patch is released, defenders should apply the following compensating controls: restrict the Editor+ role to only fully trusted users, since hook-creation permission is the required prerequisite; disable webhook notification functionality entirely via NocoDB's plugin settings if outbound webhooks are not operationally required (note: this disables all Slack/Discord/Mattermost/Teams notifications); apply host-level or network firewall rules blocking outbound requests to the cloud-metadata IMDS range (169.254.169.254) from the NocoDB server process - this prevents the highest-impact credential-theft scenario without disabling webhooks, but does not block access to other internal RFC-1918 hosts; and set NC_AUTOMATION_LOG_LEVEL to a value other than ALL to prevent response body logging, which eliminates the exfiltration amplification pathway described in the advisory. Monitor the upstream GitHub advisory at https://github.com/nocodb/nocodb/security/advisories/GHSA-2c5x-4jgf-88mj for patch availability.