NocoDB, an open‑source platform that uses spreadsheets to build databases, had an issue in its spreadsheet‑import endpoint before 2026.05.1. The endpoint, utilizing the internal function axiosRequestMake, could act as a generic HTTP proxy. It was reachable without authentication, and its URL‑extension allowlist was a regex tested against the full URL string. This allowed URLs whose query string ended in ".csv" to pass the filter, even when the underlying request pointed to a different file or domain. Server‑Side Request Forgery (CWE‑918) and inadequate input validation (CWE‑441) bypass the intended proxy restrictions, enabling an unauthenticated actor to cause the server to retrieve arbitrary resources from internal or external networks.

The issue impacts all releases of NocoDB before version 2026.05.1. The fix, released in 2026.05.1, eliminates the proxy behavior and enforces authentication for the spreadsheet‑import endpoint, making those and later releases unaffected.

With a CVSS score of 6.9, the vulnerability represents a moderate severity risk. No EPSS value is available and the flaw is not yet listed in the CISA KEV catalog. The flaw allows arbitrary outbound HTTP requests without authentication, meaning the SSRF vulnerability remains exploitable until a patch is applied.