Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-9xh3-ny95-z7c8
Vulnerability ID VCID-9xh3-ny95-z7c8
Aliases CVE-2026-46548
GHSA-2c5x-4jgf-88mj
Summary NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-918 Server-Side Request Forgery (SSRF)
System Score Found at
epss 0.00028 https://api.first.org/data/v1/epss?cve=CVE-2026-46548
epss 0.00028 https://api.first.org/data/v1/epss?cve=CVE-2026-46548
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-2c5x-4jgf-88mj
cvssv3.1 4.3 https://github.com/nocodb/nocodb
generic_textual MODERATE https://github.com/nocodb/nocodb
cvssv3.1 4.3 https://github.com/nocodb/nocodb/security/advisories/GHSA-2c5x-4jgf-88mj
cvssv3.1_qr MODERATE https://github.com/nocodb/nocodb/security/advisories/GHSA-2c5x-4jgf-88mj
generic_textual MODERATE https://github.com/nocodb/nocodb/security/advisories/GHSA-2c5x-4jgf-88mj
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-46548
https://github.com/nocodb/nocodb
GHSA-2c5x-4jgf-88mj https://github.com/advisories/GHSA-2c5x-4jgf-88mj
GHSA-2c5x-4jgf-88mj https://github.com/nocodb/nocodb/security/advisories/GHSA-2c5x-4jgf-88mj
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/nocodb/nocodb
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/nocodb/nocodb/security/advisories/GHSA-2c5x-4jgf-88mj
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.08567
EPSS Score 0.00028
Published At June 12, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T20:38:47.871684+00:00 GHSA Importer Import https://github.com/advisories/GHSA-2c5x-4jgf-88mj 38.6.0