Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the request-filtering-agent SSRF protection was non-functional in the four notification webhook plugins (Slack, Discord, Mattermost, Teams) because httpAgent / httpsAgent were passed as part of the request body rather than the axios config. An authenticated user with hook-creation permission could direct outbound POST requests to arbitrary internal hosts. This vulnerability is fixed in 2026.04.1.
Published: 2026-06-23
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Prior to the 2026.04.1 release, NocoDB’s request‑filtering‑agent SSRF protection was disabled for the Slack, Discord, Mattermost, and Teams webhook plugins because httpAgent and httpsAgent were included in the request body instead of the axios configuration. An authenticated user with hook‑creation permissions could embed these values, causing the SSRF filter to be bypassed and allowing the server to issue POST requests to arbitrary internal hosts. This could be used for data exfiltration or further network compromise, and is identified as CWE‑918.

Affected Systems

NocoDB before version 2026.04.1 when the Slack, Discord, Mattermost, and Teams webhook plugins are used. The vulnerability requires an authenticated user who has permission to create hooks in these plugins.

Risk and Exploitability

The CVSS score of 4.3 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access; a privileged user can abuse the flaw to send POST requests to arbitrary internal hosts. This could expose sensitive data or allow further lateral movement within the internal network.

Generated by OpenCVE AI on June 24, 2026 at 09:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the NocoDB 2026.04.1 release or later, which fixes the SSRF bypass
  • Limit or remove the hook‑creation permission from users who do not require it
  • Implement network segmentation or firewall rules to restrict outbound traffic from the NocoDB server to only the services that must receive webhook callbacks

Generated by OpenCVE AI on June 24, 2026 at 09:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-2c5x-4jgf-88mj NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)
History

Wed, 24 Jun 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 24 Jun 2026 01:30:00 +0000

Type Values Removed Values Added
First Time appeared Nocodb
Nocodb nocodb
Vendors & Products Nocodb
Nocodb nocodb

Tue, 23 Jun 2026 21:15:00 +0000

Type Values Removed Values Added
Description NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the request-filtering-agent SSRF protection was non-functional in the four notification webhook plugins (Slack, Discord, Mattermost, Teams) because httpAgent / httpsAgent were passed as part of the request body rather than the axios config. An authenticated user with hook-creation permission could direct outbound POST requests to arbitrary internal hosts. This vulnerability is fixed in 2026.04.1.
Title NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Nocodb Nocodb
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-06-24T12:25:20.089Z

Reserved: 2026-05-14T20:42:31.368Z

Link: CVE-2026-46548

cve-icon Vulnrichment

Updated: 2026-06-24T12:24:45.663Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-24T09:30:06Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)