Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a blind Server-Side Request Forgery (SSRF) vulnerability exists in the `uploadViaURL` functionality due to an unprotected `HEAD` request. While the subsequent file retrieval logic correctly enforces SSRF protections, the initial metadata request executes without validation. This allows limited outbound requests to arbitrary URLs before SSRF controls are applied. Version 0.301.0 contains a patch for the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-24767 Server-Side Request Forgery in NocoDB Prior to Version 0.301.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24767
Post summary
The post announces CVE-2026-24767, a Server‑Side Request Forgery in NocoDB before version 0.301.0, with a link to a vulnerability detail page but no PoC, exploit, active exploitation, or patch information.
CVE-2026-24767: Headless Horseman: NocoDB Blind SSRF via Premature HEAD Requests A blind Server-Side Request Forgery (SSRF) vulnerability in NocoDB allows authenticated users to force the server to ping internal network resources. The flaw lies in the... https://cvereports.com/reports/CVE-2026-24767
Post summary
The article announces a blind SSRF vulnerability in NocoDB that lets authenticated users force internal resource pings through premature HEAD requests.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nocodb | nocodb | - | - | - |