EUVD-2026-38621
GHSA-w43h-r5m5-p832
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (https://github.com/nocodb/nocodb) · only source for this CVE.
CVSS VectorVendor: https://github.com/nocodb/nocodb
Lifecycle Timeline
3DescriptionCVE.org
Summary
The connection-test endpoint opened a raw TCP socket to the user-supplied database host without resolving and range-checking the destination, so private and link-local addresses (including IPv4-mapped IPv6 forms and localhost) reached the driver.
Details
A new validateDbConnectionHost helper resolves hostnames through DNS, parses each address with ipaddr.js, normalises IPv4-mapped IPv6, and rejects addresses in the private, loopback, link-local, unique-local, reserved, unspecified, broadcast, and carrier-grade-NAT ranges. 0.0.0.0, ::, and the literal localhost are special-cased. The check runs before the existing SSL block in the connection-test controller and gates the driver invocation.
Impact
Authenticated users with connection-test permission could probe internal services (Redis, the cloud metadata endpoint, internal databases) reachable from the NocoDB process. A DNS rebinding attacker could still race the resolve-vs-connect window.
Credit
This issue was reported by @helwor-01.
AnalysisAI
Server-Side Request Forgery in NocoDB (npm/nocodb, versions up to and including 2026.05.0) allows authenticated users with connection-test permission to direct the NocoDB server process to open raw TCP sockets to attacker-specified internal destinations, including Redis instances, cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), and internal databases. The vulnerable connection-test endpoint accepted user-supplied database hostnames without DNS resolution or address-range validation, effectively making NocoDB an unauthenticated SSRF proxy to the internal network from the server's vantage point. No public exploit has been identified at time of analysis; a vendor-released patch exists in version 2026.05.1.
Technical ContextAI
NocoDB is an open-source no-code database platform distributed as the npm package pkg:npm/nocodb. The vulnerable code path is the connection-test controller endpoint, which accepted a user-supplied database host parameter and passed it directly to a database driver without first resolving or range-checking the destination address. This is classified as CWE-918 (Server-Side Request Forgery): the application acts as an inadvertent network proxy by initiating outbound TCP connections at attacker direction. Critically, the raw socket was opened before any SSL validation block, meaning the SSRF precedes even TLS gating. The fix introduces a validateDbConnectionHost helper that resolves hostnames through DNS, parses each resulting address using the ipaddr.js library, normalizes IPv4-mapped IPv6 forms (a common bypass vector), and rejects addresses in private, loopback, link-local, unique-local, reserved, unspecified, broadcast, and carrier-grade-NAT ranges. Literal values 0.0.0.0, ::, and the string localhost are additionally special-cased. The advisory explicitly acknowledges a residual DNS rebinding risk in the resolve-versus-connect window, which the patch does not fully close.
RemediationAI
Upgrade NocoDB to version 2026.05.1 or later - the vendor-confirmed fixed release per GitHub release tag https://github.com/nocodb/nocodb/releases/tag/2026.05.1 and advisory GHSA-w43h-r5m5-p832. For installations that cannot be immediately patched, revoke or restrict the connection-test permission from all non-administrator NocoDB users; this eliminates the SSRF attack surface entirely but prevents users from self-testing database connectivity, requiring administrators to perform that function. In cloud environments, apply host-level or VPC egress firewall rules blocking outbound connections from the NocoDB process to 169.254.169.254 (AWS/GCP metadata), RFC-1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and loopback addresses - note this may conflict with legitimate internal database connectivity and requires careful rule scoping. To address the residual DNS rebinding risk acknowledged in the advisory even after patching to 2026.05.1, deploy a DNS resolver with rebind-protection enabled (e.g., dnsmasq --stop-dns-rebind, Unbound's private-address directive, or a DNS RPZ blocking private-range responses) on the NocoDB host's resolver path; the trade-off is that this may block split-horizon DNS setups where internal hostnames resolve to private addresses.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.v
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today