EUVD-2026-38601
GHSA-h6vv-pcq8-7xm4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network endpoint gated on workspace owner role (PR:H); scope changes because worker reaches systems beyond NocoDB itself; confidentiality high due to file read; integrity low for potential internal service interaction.
Primary rating from Vendor (https://github.com/nocodb/nocodb).
CVSS VectorVendor: https://github.com/nocodb/nocodb
Lifecycle Timeline
4DescriptionCVE.org
Summary
The base-migration endpoint accepted a caller-supplied URL that the migration worker dereferenced without enforcing protocol or destination, allowing scheme abuse (file:, ftp:, etc.) and probing of internal HTTP destinations.
Details
The migrate endpoint is restricted to the workspace owner role by ACL. The remaining gaps were (a) protocol validation - the controller now parses body.migrationUrl as a URL and rejects anything whose protocol is not http: or https: - and (b) private destination filtering - the worker already runs through useAgent(targetUrl) from request-filtering-agent, which blocks RFC 1918, loopback, and link-local at the socket layer.
Impact
With the workspace owner role, a malformed URL could be used to coerce the migration worker into reading local files or talking to non-HTTP services; combined with the HTTP-only filter, owner-supplied targets could not reach private ranges.
Credit
This issue was reported by Devel Group Security Research Team through @TREXNEGRO. It was independently reported by @Lihfdgjr and [@bugbunny-research (https://github.com/bugbunny-research).
AnalysisAI
Server-Side Request Forgery in NocoDB's base-migration endpoint allows authenticated workspace owners to coerce the migration worker into issuing requests using arbitrary URL schemes - including file:// and ftp:// - enabling local file disclosure and interaction with non-HTTP services. The affected package is pkg:npm/nocodb at versions up to and including 0.301.3; no released patched version has been confirmed at time of analysis. Exploitation is constrained to principals holding the workspace owner role, but within that privilege tier no additional conditions are required to trigger the vulnerability. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Technical ContextAI
NocoDB is an open-source no-code database platform distributed as an npm package (pkg:npm/nocodb). The vulnerable component is the base-migration controller, which exposes a migrate endpoint that accepts a caller-supplied migrationUrl and passes it to an internal migration worker for HTTP dereferencing. The root cause (CWE-918: Server-Side Request Forgery) is the absence of protocol allowlisting on the ingested URL: the controller did not parse or validate the scheme before forwarding the URL to the worker, permitting non-HTTP schemes (file:, ftp:, gopher:, etc.) to be processed. An independent gap existed in destination filtering - while the request-filtering-agent library (useAgent) was already integrated to block RFC 1918, loopback (127.0.0.0/8), and link-local ranges at the socket layer for HTTP URLs, scheme-abusing URLs bypassed this filter entirely because the socket layer was never reached for file:// or ftp:// payloads. The advisory describes a two-part remediation: (a) URL parsing in the controller to enforce http: or https: protocol, and (b) reliance on the existing request-filtering-agent for private-range blocking on HTTP targets.
RemediationAI
No vendor-released patched version of pkg:npm/nocodb has been confirmed at time of analysis - fixed_in is listed as None in the advisory package data, despite the advisory describing the intended fix approach. Organizations running NocoDB versions at or below 0.301.3 should take the following interim compensating controls: First, restrict the workspace owner role strictly to trusted internal accounts and audit all current workspace owner assignments, since exploitation is gated on that role. Second, if the migrate endpoint is not operationally required, consider disabling it at the reverse proxy or network layer by blocking requests to the base-migration route - this eliminates the attack surface entirely but will break legitimate migration workflows. Third, ensure the NocoDB process runs under a least-privilege OS user with read access restricted to only the directories it requires, limiting the value of file:// scheme exploitation. Fourth, enforce network egress restrictions on the NocoDB host to prevent the worker from reaching sensitive internal services that lack authentication. Monitor the upstream advisory at https://github.com/nocodb/nocodb/security/advisories/GHSA-h6vv-pcq8-7xm4 for a patched release version and apply it as the primary fix once available.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today