PostgreSQL CVE-2026-34825

Requires authenticated user with permission to create or modify NocoBase workflows containing SQL nodes. User-controlled data must be incorporated as template variables in the SQL query within the workflow. Affects NocoBase <= 2.0.8 plugin-workflow-sql component.

This vulnerability presents critical real-world risk despite the absence of CVSS scoring. Authentication is required (workflow trigger access), but exploitation complexity is low-attackers need only craft malicious input values when triggering workflows containing SQL nodes with template variables. The publicly available proof-of-concept demonstrates trivial exploitation using UNION-based injection techniques. While no CISA KEV entry exists indicating mass exploitation campaigns, the public POC and detailed technical disclosure significantly lower the barrier to exploitation. The attack is partially automatable once an attacker identifies workflows with vulnerable SQL nodes and determines how to trigger them. Technical impact is severe: confidentiality, integrity, and availability are all compromised through full database access. The primary limiting factor is that exploitation requires both authenticated workflow trigger capability AND the presence of admin-configured SQL nodes using user-controlled template variables-this reduces the attack surface compared to unauthenticated vulnerabilities, but any NocoBase deployment using workflow SQL automation with external data sources remains at critical risk. Organizations should treat this as high priority given the combination of low exploitation complexity, public POC availability, and catastrophic impact potential.

An authenticated attacker with permission to create user accounts or trigger collection-based workflows identifies that the NocoBase deployment uses a workflow with a SQL node querying user data. The workflow contains a template like SELECT * FROM users WHERE nickname = '{{$context.data.nickname}}'. The attacker creates a new user account with the nickname field set to a malicious payload: ' UNION SELECT 1,password_hash,email FROM admin_credentials--. When the workflow executes, the unescaped template substitution produces the SQL query SELECT * FROM users WHERE nickname = '' UNION SELECT 1,password_hash,email FROM admin_credentials--', which returns administrator password hashes and email addresses in the workflow execution results accessible to the attacker. With database credentials extracted, the attacker escalates to full database access, exfiltrating sensitive application data or modifying records to grant themselves administrative privileges within NocoBase.