Security readout for executives and security teams
Plain-English summary
CVE-2026-24767 affects NocoDB before 0.301.0. A URL upload feature can make an unvalidated outbound HEAD request before SSRF protections run. This could let an authenticated user cause limited server-side requests to arbitrary URLs. The published severity is medium, and the source bundle does not indicate active exploitation.
Executive priority
Treat as a near-term patching item for NocoDB environments. Business urgency is moderate: exploitation appears constrained, but SSRF can expose internal network paths or metadata if egress is permissive. Prioritize internet-facing or multi-user deployments.
Technical view
The issue is a blind SSRF in NocoDB uploadViaURL. The initial metadata HEAD request is not protected, while later file retrieval SSRF controls are enforced. CVSS 3.1 is 4.9 with network access, low privileges, high complexity, and changed scope. Patched in NocoDB 0.301.0.
Likely exposure
Organizations running NocoDB versions earlier than 0.301.0 are affected, especially where low-privileged authenticated users can access URL-based upload functionality. Exposure depends on deployment network egress and access to internal services.
Exploitation context
Sources describe limited outbound arbitrary URL requests through an unvalidated HEAD request. The vulnerability is blind, requires low privileges, and has high attack complexity. CISA KEV is false in the provided bundle, and no cited source reports active exploitation.
Researcher notes
Evidence is limited to the CVE record and GitHub advisory. The key flaw is the pre-validation HEAD request in uploadViaURL, not the later retrieval path. Do not assume broader SSRF impact beyond the documented limited outbound request behavior.
Mitigation direction
- Upgrade NocoDB to version 0.301.0 or later.
- Review vendor advisory GHSA-xr7v-j379-34v9 for current guidance.
- Restrict outbound network access from NocoDB where operationally feasible.
- Limit access to URL upload functionality to trusted users until patched.
Validation and detection
- Inventory all NocoDB instances and record versions.
- Confirm affected instances are below version 0.301.0.
- Verify whether uploadViaURL functionality is enabled or accessible.
- Review outbound request logs for unusual NocoDB-originated HEAD requests.
- Confirm patched instances report version 0.301.0 or later.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-918: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCloud metadata behavior lookup
The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-24767 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N1.82.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.9MediumVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/nocodb/nocodb/security/advisories/GHSA-xr7v-j379-34v9CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.