The flaw resides in a base‑migration endpoint that accepts a user supplied URL and has no validation of the protocol or destination. An attacker can supply URLs prefixed with file:, ftp: or other unsupported schemes and the worker will dereference them, potentially causing the server to access arbitrary network locations, read sensitive files or internal services, and probe internal HTTP destinations. The vulnerability is considered an SSRF weakness (CWE‑918).

This vulnerability affects all deployments of NocoDB running a version earlier than 2026.05.1. The product and vendor are specified as NocoDB, NocoDB. Newer releases beginning with 2026.05.1 contain a fix that validates the URL scheme and restricts outbound requests.

The CVSS score of 5.1 classifies it as a medium impact vulnerability. EPSS is not available and the issue is not currently listed in CISA’s KEV catalog. The attack vector is inferred to be remote, via the exposed base-migration API; an authorized user or one who can send requests to the endpoint can trigger the malicious request. The potential exploitation can lead to internal network mapping, exfiltration of sensitive data, or access to internal services that are not exposed externally. Because the weakness does not require privileged privileges on the host, the risk remains meaningful for organizations that expose the base‑migration endpoint to untrusted actors.