CVE-2026-24767 is a low severity vulnerability with a CVSS score of 0.0. No known public exploits at this time.
Very low probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
A blind Server-Side Request Forgery (SSRF) vulnerability exists in the uploadViaURL functionality due to an unprotected HEAD request. While the subsequent file retrieval logic correctly enforces SSRF protections, the initial metadata request executes without validation.
This allows limited outbound requests to arbitrary URLs before SSRF controls are applied.
The uploadViaURL() function issues an axios.head() request to retrieve metadata (content type, content length, and final URL after redirects). This request is performed without SSRF filtering.
Although the actual file download is protected by request filtering, the initial HEAD request occurs prior to these checks and can be triggered with an attacker-controlled URL.
if (!url.startsWith('data:')) {
response = await axios.head(url, { maxRedirects: 5 });
mimeType = response.headers['content-type']?.split(';')[0];
size = response.headers['content-length'];
finalUrl = response.request.res.responseUrl;
}
The impact of this issue is limited due to the following constraints:
HEAD requests are affected (no response body is returned)However, the vulnerability may still allow:
HEAD requestsHEAD requestsThis issue does not provide arbitrary data access or full internal network compromise on its own.
Moderate
Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.
The vulnerability is limited in scope and impact:
HEAD requests are affectedWhile the issue permits blind outbound requests to attacker-controlled URLs, it does not enable direct data exfiltration or full internal network compromise on its own.
curl -X POST 'http://localhost:8080/api/v2/storage/upload-by-url' \
-H 'Content-Type: application/json' \
-H 'xc-auth: <token>' \
-d '[{
"url": "http://169.254.169.254/latest/meta-data/",
"fileName": "test.txt"
}]'
This request causes the server to issue an unfiltered HEAD request before SSRF protections are applied.
This issue was first identified and responsibly disclosed by Faizan Raza of Kolega.dev as part of a security assessment using Kolega.dev Deep Code Scan, including validation and fix recommendations.
NocoDB also acknowledges Neel B for independently reporting the same issue prior to publication.
NocoDB thanks Kolega.dev for their contribution to improving the security posture of the project.