A user‑supplied database host sent to NocoDB’s connection‑test endpoint opens a raw TCP socket to that host without any resolution or range validation. As a result, an attacker can force the server to connect to arbitrary IP addresses, including private, link‑local, and localhost addresses, enabling internal network discovery, data exfiltration, or leveraging the server as a proxy. This flaw is a classic input‑validation weakness (CWE‑918).

The nocodb:nocodb product, NocoDB, in all versions before 2026.05.1 is vulnerable. Upgrading to 2026.05.1 or later resolves the issue.

The CVSS score of 5.3 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is the publicly exposed connection‑test endpoint, which accepts any host string. Exploitation requires the attacker to trigger the endpoint with a crafted host. The risk is moderate but present.