CVE-2026-24767: 
JavaScript vulnerability analysis and mitigation

CVE-2026-24767 is a blind Server-Side Request Forgery (SSRF) vulnerability in NocoDB's uploadViaURL functionality, caused by an unprotected HEAD request that executes without SSRF validation. It affects all NocoDB versions prior to 0.301.0 (npm package). The vulnerability was published and patched on January 28, 2026. It carries a CVSS v3.1 base score of 4.9 (Moderate) per the official GitHub Security Advisory, though Feedly's data notes an alternate score of 6.4 (GitHub Advisory, NocoDB Advisory).

The root cause (CWE-918: Server-Side Request Forgery) lies in the uploadViaURL() function, which issues an axios.head() call to retrieve metadata (content type, content length, and final URL after redirects) before any SSRF filtering is applied. The vulnerable code path is: response = await axios.head(url, { maxRedirects: 5 }); — this executes with up to 5 redirects against an attacker-supplied URL, with no allowlist or blocklist validation. While the subsequent file-download logic does enforce SSRF protections, the initial HEAD request is entirely unguarded, allowing an authenticated attacker to trigger outbound requests to arbitrary internal or external endpoints (NocoDB Advisory, GitHub Advisory).

Exploitation allows an authenticated attacker to cause the NocoDB server to issue unvalidated outbound HEAD requests to arbitrary URLs, including internal network resources such as cloud metadata endpoints (e.g., http://169.254.169.254/). Because only HEAD requests are issued, no response body is returned to the attacker, limiting direct data exfiltration; however, the vulnerability enables blind internal service probing (reachability detection), interaction with sensitive internal endpoints that respond to HEAD requests, and potential chaining with other vulnerabilities for broader internal network reconnaissance. Availability is not impacted (NocoDB Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating exploitation via a simple curl POST request to /api/v2/storage/upload-by-url with an attacker-controlled URL. Exploitation requires low privileges (a valid authentication token) and network access to the NocoDB instance. There is no evidence of in-the-wild exploitation at this time, no known threat actor attribution, and the EPSS score is approximately 0.015% (3rd percentile). The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, NocoDB Advisory).

1. Obtain authentication token: Log in to the target NocoDB instance with any valid low-privilege account and retrieve the xc-auth JWT token from the login API response.
2. Identify the vulnerable endpoint: Confirm the target is running NocoDB < 0.301.0 and that the /api/v2/storage/upload-by-url endpoint is accessible.
3. Craft the SSRF payload: Prepare a POST request with a JSON body containing an attacker-controlled URL targeting an internal resource (e.g., cloud metadata at http://169.254.169.254/latest/meta-data/ or an internal service IP).
4. Send the request: Execute the following:

curl -X POST 'http://<target>:8080/api/v2/storage/upload-by-url' \
  -H 'Content-Type: application/json' \
  -H 'xc-auth: <JWT_TOKEN>' \
  -d '[{ "url": "http://169.254.169.254/latest/meta-data/", "fileName": "test.txt" }]'

5. Observe blind SSRF: The NocoDB server issues an unfiltered HEAD request to the specified URL. Monitor an attacker-controlled server (e.g., using Burp Collaborator or interactsh) to confirm outbound requests and infer internal network reachability from server responses or timing (NocoDB Advisory, GitHub Advisory).

• Network: Unexpected outbound HEAD requests from the NocoDB server to internal IP ranges (e.g., 169.254.169.254, 10.0.0.0/8, 192.168.0.0/16) or to external out-of-band interaction servers; unusual HTTP HEAD traffic originating from the NocoDB process.
• Logs: NocoDB application logs showing repeated POST requests to /api/v2/storage/upload-by-url with suspicious or internal URLs in the request body; HTTP access logs recording 200/4xx responses to HEAD requests targeting non-public addresses.
• Process/Application: Axios HTTP client activity in NocoDB logs initiating HEAD requests to unexpected destinations, particularly with redirect chains (maxRedirects: 5) to internal endpoints.

Upgrade NocoDB to version 0.301.0 or later, which contains the patch that applies SSRF validation to the initial HEAD request in uploadViaURL(). No official configuration-based workaround is provided; as an interim measure, implement network-level egress filtering on the NocoDB server host to restrict outbound connections to only trusted, necessary endpoints. Additionally, enforce the principle of least privilege by limiting which users can access the file upload functionality (NocoDB Advisory, GitHub Advisory).

The vulnerability was responsibly disclosed by Faizan Raza of Kolega.dev as part of a security assessment using Kolega.dev Deep Code Scan, with independent reporting also credited to Neel B. NocoDB's maintainer (mertmit) published the advisory and patch on January 28, 2026, acknowledging both reporters. No significant broader media coverage or notable community debate has been observed beyond the advisory publication (NocoDB Advisory).