What is CVE-2026-24767?

CVE-2026-24767 is a medium-severity vulnerability in Nocodb, classified under Server-Side Request Forgery (SSRF). CVSS score: 4.9/10. Published 2026-01-28.

How severe is CVE-2026-24767?

Medium severity. CVSS v3 base score is 4.9 out of 10.

SSRF in Nocodb

CVE-2026-24767

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a blind Server-Side Request Forgery (SSRF) vulnerability exists in the `uploadViaURL` functionality due to an unprotected `HEAD` request. While the subsequent file retrieval logic correctly enforces SSRF protections, the initial metadata request executes without validation. This allows limited outbound requests to arbitrary URLs before SSRF controls are applied. Version 0.301.0 contains a patch for the issue.

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.002 (9.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N.

Affected products

Nocodb — versions < 0.301.0

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)

Frequently asked questions

What is CVE-2026-24767?: CVE-2026-24767 is a medium-severity vulnerability in Nocodb, classified under Server-Side Request Forgery (SSRF). CVSS score: 4.9/10. Published 2026-01-28.
How severe is CVE-2026-24767?: Medium severity. CVSS v3 base score is 4.9 out of 10.