→

CVE-2026-53930: NocoDB: Server-Side Request Forgery via Base Migration URL

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the base-migration endpoint accepted a caller-supplied URL that the migration worker dereferenced without enforcing protocol or destination, allowing scheme abuse (file:, ftp:, etc.) and probing of internal HTTP destinations. This vulnerability is fixed in 2026.05.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-53930

CVE-2026-53930:

5.1

CVSS Score

4.0

-

CVSS Score

-

Basic Information

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nocodb	npm	<= 0.301.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) that allows a malicious actor to make the server send requests to arbitrary URLs. The provided patch fixes an SSRF vulnerability in the webhook notification mechanism. The sendMessage function in various webhook plugins (Discord, Mattermost, Slack, Teams) was vulnerable because it did not correctly apply the SSRF protection agent when sending requests with axios. An attacker with the ability to configure webhooks could have exploited this to probe internal networks or access local files. The fix involves moving the SSRF protection agent configuration to the correct place in the axios call. While the advisory mentions a vulnerability in the base-migration endpoint, the only relevant security fix found in the specified version range is for the webhook mechanism.

Vulnerable functions

Discord.sendMessage

packages/nocodb/src/plugins/discord/Discord.ts

The `sendMessage` function was vulnerable to SSRF because the `httpAgent` and `httpsAgent` for SSRF protection were passed in the request body instead of the axios configuration. This meant the `useAgent` protection was not being applied, allowing an attacker to provide a malicious webhook URL that could be used to probe internal networks or access local files.

Mattermost.sendMessage

packages/nocodb/src/plugins/mattermost/Mattermost.ts

The `sendMessage` function was vulnerable to SSRF because the `httpAgent` and `httpsAgent` for SSRF protection were passed in the request body instead of the axios configuration. This meant the `useAgent` protection was not being applied, allowing an attacker to provide a malicious webhook URL that could be used to probe internal networks or access local files.

Slack.sendMessage

packages/nocodb/src/plugins/slack/Slack.ts

The `sendMessage` function was vulnerable to SSRF because the `httpAgent` and `httpsAgent` for SSRF protection were passed in the request body instead of the axios configuration. This meant the `useAgent` protection was not being applied, allowing an attacker to provide a malicious webhook URL that could be used to probe internal networks or access local files.

Teams.sendMessage

packages/nocodb/src/plugins/teams/Teams.ts

The `sendMessage` function was vulnerable to SSRF because the `httpAgent` and `httpsAgent` for SSRF protection were passed in the request body instead of the axios configuration. This meant the `useAgent` protection was not being applied, allowing an attacker to provide a malicious webhook URL that could be used to probe internal networks or access local files.

Vulnerability Intelligence
Miggo AI

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-53930: NocoDB: Server-Side Request Forgery via Base Migration URL

CVE-2026-53930:

5.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Basic Information

Basic Information

5.1

5.1

CVE-2026-53930: NocoDB: Server-Side Request Forgery via Base Migration URL

5.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-53930: NocoDB: Server-Side Request Forgery via Base Migration URL

CVE-2026-53930:

5.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Basic Information

Basic Information

5.1

5.1

CVE-2026-53930: NocoDB: Server-Side Request Forgery via Base Migration URL

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI