CVE-2026-24767
published 2026-01-28CVE-2026-24767: NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a blind Server-Side Request Forgery (SSRF) vulnerability exists in the…
PriorityP339medium6.4CVSS 3.1
AVNACLPRLUINSCCLILAN
EPSS
0.20%
9.8th percentile
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a blind Server-Side Request Forgery (SSRF) vulnerability exists in the `uploadViaURL` functionality due to an unprotected `HEAD` request. While the subsequent file retrieval logic correctly enforces SSRF protections, the initial metadata request executes without validation. This allows limited outbound requests to arbitrary URLs before SSRF controls are applied. Version 0.301.0 contains a patch for the issue.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | lxc_incus_v6_cmd_incusd | >= 0 < 7.0.0 | 7.0.0 |
| linuxcontainers | incus | < 7.0.0 | 7.0.0 |
| lxc | incus | < 7.0.0 | 7.0.0 |
| nocodb | nocodb | < 0.301.0 | 0.301.0 |
| nocodb | nocodb | >= 0 < 0.301.0 | 0.301.0 |
CVSS provenance
nvdv3.16.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
ghsa6.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Incus has Blind SSRF via Image Import Preflight HEAD
ghsa·2026-05-04·CVSS 6.4
CVE-2026-35527 [MEDIUM] CWE-918 Incus has Blind SSRF via Image Import Preflight HEAD
Incus has Blind SSRF via Image Import Preflight HEAD
### Summary
A partial implementation of our `restricted.images.servers` project restriction allows users in such restricted projects to still cause Incus to send HEAD requests to arbitrary endpoints.
The actual image download will be rejected by the project restriction, but the ability to trigger arbitrary HTTP requests inside of the Incus environment can still be used as a way to discover otherwise hidden details about the environment.
### Details
The image import flow performs outbound network access to a user-supplied URL before the request is fully validated and before the import is rejected. The URL information helper constructs a HEAD request directly from the supplied source URL and immediately sends it to resolve image metadat
GHSA
NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality
ghsa·2026-01-28
CVE-2026-24767 [MEDIUM] CWE-918 NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality
NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality
## Summary
A **blind Server-Side Request Forgery (SSRF)** vulnerability exists in the `uploadViaURL` functionality due to an unprotected `HEAD` request. While the subsequent file retrieval logic correctly enforces SSRF protections, the initial metadata request executes without validation.
This allows limited outbound requests to arbitrary URLs before SSRF controls are applied.
---
## Vulnerability Details
The `uploadViaURL()` function issues an `axios.head()` request to retrieve metadata (content type, content length, and final URL after redirects). This request is performed **without SSRF filtering**.
Although the actual file download is protected by request filtering, the initial `HEAD` request occurs
OSV
NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality
osv·2026-01-28
CVE-2026-24767 [MEDIUM] NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality
NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality
## Summary
A **blind Server-Side Request Forgery (SSRF)** vulnerability exists in the `uploadViaURL` functionality due to an unprotected `HEAD` request. While the subsequent file retrieval logic correctly enforces SSRF protections, the initial metadata request executes without validation.
This allows limited outbound requests to arbitrary URLs before SSRF controls are applied.
---
## Vulnerability Details
The `uploadViaURL()` function issues an `axios.head()` request to retrieve metadata (content type, content length, and final URL after redirects). This request is performed **without SSRF filtering**.
Although the actual file download is protected by request filtering, the initial `HEAD` request occurs
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-35527 github.com/lxc/incus: Incus: Server-Side Request Forgery (SSRF) allows information disclosure
bugzilla·2026-05-05·CVSS 6.4
CVE-2026-35527 [MEDIUM] CVE-2026-35527 github.com/lxc/incus: Incus: Server-Side Request Forgery (SSRF) allows information disclosure
CVE-2026-35527 github.com/lxc/incus: Incus: Server-Side Request Forgery (SSRF) allows information disclosure
Incus is an open source container and virtual machine manager. In versions prior to 7.0.0, the image import flow issues an outbound HEAD request to a user-supplied URL before validating the request against project restrictions such as restricted.images.servers. The imgPostURLInfo function constructs and sends a HEAD request directly from the attacker-supplied source URL to resolve image metadata, and this network interaction occurs before the flow reaches the point where the import would be rejected by policy. Although the actual image download is blocked by the project restriction, an authenticated user can coerce the daemon into making blind HEAD requests to arbitrary destination
Wiz
CVE-2026-24767 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.9
CVE-2026-24767 [MEDIUM] CVE-2026-24767 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-24767 :
JavaScript vulnerability analysis and mitigation
uploadViaURL
HEAD
Source : NVD
## 6.4
Score
Published January 28, 2026
Severity MEDIUM
CNA Score 4.9
Affected Technologies
JavaScript
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 2.5
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nocodb
Sources
NVD
npm Severity MEDIUM Has Fix Added at: Jan 29, 2026
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Related JavaScript vulnerabilities:
CVE ID
Severity
Score
Technologies
Component name
CISA KEV exploit
Has fix
Published date
CVE-2026-3
2026-01-28
Published