CVE-2026-53930

描述

### Summary The base-migration endpoint accepted a caller-supplied URL that the migration worker dereferenced without enforcing protocol or destination, allowing scheme abuse (`file:`, `ftp:`, etc.) and probing of internal HTTP destinations. ### Details The `migrate` endpoint is restricted to the workspace owner role by ACL. The remaining gaps were (a) protocol validation — the controller now parses `body.migrationUrl` as a `URL` and rejects anything whose protocol is not `http:` or `https:` — and (b) private destination filtering — the worker already runs through `useAgent(targetUrl)` from `request-filtering-agent`, which blocks RFC 1918, loopback, and link-local at the socket layer. ### Impact With the workspace owner role, a malformed URL could be used to coerce the migration worker into reading local files or talking to non-HTTP services; combined with the HTTP-only filter, owner-supplied targets could not reach private ranges. ### Credit This issue was reported by Devel Group Security Research Team through [@TREXNEGRO](https://github.com/TREXNEGRO). It was independently reported by [@Lihfdgjr](https://github.com/Lihfdgjr) and [@bugbunny-research (https://github.com/bugbunny-research).

如何修補 CVE-2026-53930

目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。

• —未列出修補版本

CVE-2026-53930 正在被利用嗎?

低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, <= 0.301.3

CVSS 分數

參考連結(3)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-53930
• PATCHgithub.com/nocodb/nocodb
• WEBgithub.com/nocodb/nocodb/security/advisories/GHSA-h6vv-pcq8-7xm4