CVE-2026-47382: NocoDB: Server-Side Request Forgery via Database Connection Host

June 5, 2026 (updated July 20, 2026)

The connection-test endpoint opened a raw TCP socket to the user-supplied database host without resolving and range-checking the destination, so private and link-local addresses (including IPv4-mapped IPv6 forms and localhost) reached the driver.

References

github.com/advisories/GHSA-w43h-r5m5-p832
github.com/nocodb/nocodb/releases/tag/2026.05.1
github.com/nocodb/nocodb/security/advisories/GHSA-w43h-r5m5-p832
nvd.nist.gov/vuln/detail/CVE-2026-47382

Code Behaviors & Features

Detect and mitigate CVE-2026-47382 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →