CVE-2026-46548

Description

NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)

Overview

State

—

Assigner (CNA)

—

CVSS severity

medium

CVSS score

4.3 / 10

CVSS vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Effective score

4.3 / 10 MEDIUM source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2026-46548

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-38587

Assigner

GitHub_M

Published

Jun 23, 2026, 8:41:06 PM

Updated

Jun 24, 2026, 12:25:20 PM

EUVD base score (CVSS 3.1)

4.3 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EUVD-reported EPSS

0.1800

Vendors

nocodb

Products

nocodb (< 2026.04.1)

Aliases

GHSA-2c5x-4jgf-88mj

ENISA description: NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the request-filtering-agent SSRF protection was non-functional in the four notification webhook plugins (Slack, Discord, Mattermost, Teams) because httpAgent / httpsAgent were passed as part of the request body rather than the axios config. An authenticated user with hook-creation permission could direct outbound POST requests to arbitrary internal hosts. This vulnerability is fixed in 2026.04.1.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (2)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://nvd.nist.gov/vuln/detail/CVE-2026-46548 tenable:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2026-46548 tenable:www.cve.org

• Microsoft Defender CVE-2026-41091 and CVE-2026-45498 Exploited
  web:blog.gridinsoft.com

  Microsoft has confirmed exploitation of two Microsoft Defender vulnerabilities fixed in the May 2026 security update cycle. CVE - 2026 -41091 is an elevation-of-privilege flaw in the Microsoft Malware Protection Engine, while CVE - 2026 -45498 is a denial-of-service flaw in the Microsoft Defender Antimalware Platform . The first bug matters more for incident response because a local authorized ...

  2026-05-26 03:08 UTC
• CISA Warns of Exploited Microsoft Defender 0-Day Flaws
  web:cyberpress.org

  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing an urgent remediation directive for federal agencies with a due date of June 3, 2026 .

  2026-05-26 03:08 UTC
• Security Update Guide - Loading - Microsoft
  web:msrc.microsoft.com

  Security Updates Acknowledgements

  2026-05-26 03:08 UTC
• Nvd - Cve-2026-8548
  web:nvd.nist.gov

  An official website of the United States government Here's how you know

  2026-05-26 03:08 UTC
• Microsoft Defender CVE-2026-41091 & CVE-2026-45498
  web:thecyberexpress.com

  Microsoft confirms active exploitation of CVE - 2026 -41091 and CVE - 2026 -45498 in Defender, with CVSS-rated risks, KEV listing, and urgent patches issued.

  2026-05-26 03:08 UTC
• Microsoft Warns of Two Actively Exploited Defender Vulnerabilities
  web:thehackernews.com

  Microsoft has disclosed that a privilege escalation and a denial-of-service flaw in Defender has come under active exploitation in the wild. The former, tracked as CVE - 2026 -41091, is rated 7.8 on the CVSS scoring system. Successful exploitation of the flaw could allow an attacker to gain SYSTEM privileges. "Improper link resolution before file access ('link following') in Microsoft Defender ...

  2026-05-26 03:08 UTC
• 138 CVEs Fixed: Netlogon RCE Leads Microsoft's Patch Pack - DNS Bug ...
  web:vulert.com

  Microsoft's May 2026 Patch Tuesday fixes 138 vulnerabilities, including critical Windows DNS and Netlogon RCE flaws. Learn the risks, key CVEs , mitigation steps, and how Vulert can help.

  2026-05-26 03:08 UTC
• Microsoft Patches Two Actively Exploited Defender Zero-Days on Windows
  web:windowsreport.com

  Microsoft patched two actively exploited Defender zero-days affecting Windows systems and security components.

  2026-05-26 03:08 UTC
• Critical Microsoft Defender Vulnerabilities: How to Patch CVE-2026 ...
  web:www.archynewsy.com

  Understanding the Exploited Vulnerabilities The security risks involve two distinct CVE -tracked flaws that Microsoft has addressed in its latest updates: Critical Microsoft Defender Vulnerabilities Antimalware Platform CVE - 2026 -41091 (CVSS Score: 7.8): This vulnerability involves improper link resolution before file access, commonly known as "link following." By successfully exploiting ...

  2026-05-26 03:08 UTC
• Microsoft Defender vulnerabilities exploited in the wild (CVE-2026 ...
  web:www.helpnetsecurity.com

  Attackers are actively exploiting two Microsoft Defender vulnerabilities ( CVE - 2026 -41091 and CVE - 2026 -45498), Microsoft acknowledged.

  2026-05-26 03:08 UTC

Only Available for Registered Users. Sign in to view.