What is the CVSS score of CVE-2026-52888?

CVE-2026-52888 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2026-52888?

Yes, a public proof-of-concept exploit is available for CVE-2026-52888. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-52888?

Yes, a patch is available for CVE-2026-52888. Update the affected software to the latest version immediately.

NocoBase CVE-2026-52888

EUVD-2026-44800 MEDIUM

Incomplete List of Disallowed Inputs (CWE-184)

2026-07-15 GitHub_M

GHSA-v8vm-cqh8-q87q

Information Disclosure PostgreSQL Nocobase

6.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.8 MEDIUM

Admin role required to access SQL Collection (PR:H); scope changes as query reaches PostgreSQL system catalogs (S:C); confidentiality high (password hashes); no integrity or availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 15, 2026 - 22:33 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 21:01 vuln.today

Analysis Generated

Jul 15, 2026 - 21:01 vuln.today

DescriptionCVE.org

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.59 and earlier, NocoBase @nocobase/plugin-collection-sql used the checkSQL() function in packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts with an incomplete keyword blacklist that did not restrict PostgreSQL system catalog tables such as pg_shadow, pg_roles, and pg_stat_activity, allowing an admin-role user to read password hashes and database metadata through the SQL Collection feature. This vulnerability is fixed in 2.1.0-alpha.46.

AnalysisAI

PostgreSQL password hash disclosure in NocoBase 2.0.59 and earlier allows an authenticated administrator to extract pg_shadow credential hashes and database metadata by submitting raw SQL queries that reference system catalog tables omitted from the checkSQL() keyword blacklist. The SQL Collection plugin's blocklist-based validation failed to restrict pg_shadow, pg_roles, pg_stat_activity, and information_schema, and the commit diff confirms the bypass also worked via subquery wrapping (e.g., SELECT * FROM (SELECT usename, passwd FROM pg_shadow) AS passwords). No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; a vendor-released patch is available in v2.1.0-alpha.46.

Technical ContextAI

The affected component is @nocobase/plugin-collection-sql, a NocoBase plugin that allows administrators to define database-backed views using raw SQL through the 'SQL Collection' feature. Input is gated by the checkSQL() function in packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts, which implements CWE-184 (Incomplete List of Disallowed Inputs) - a blocklist approach that originally omitted the PostgreSQL system catalog identifiers pg_shadow (password hashes), pg_authid, pg_auth_members, pg_roles, pg_stat_activity, pg_catalog, and the information_schema schema. The CVSS Scope:Changed metric reflects that the query crosses from the NocoBase application boundary into the PostgreSQL system catalog layer. A secondary bug - sql.trim().split(';').shift() could return undefined rather than an empty string - was also patched in the same commit, closing a potential edge-case bypass. The CPE cpe:2.3:a:nocobase:nocobase:*:*:*:*:*:*:*:* covers all NocoBase versions through 2.0.59. The vulnerability is PostgreSQL-specific; pg_shadow and related catalogs do not exist in MySQL or SQLite deployments.

RemediationAI

Upgrade to NocoBase 2.1.0-alpha.46 or later, which expands the checkSQL() blocklist to include pg_catalog, pg_shadow, pg_authid, pg_auth_members, pg_roles, pg_stat_activity, and information_schema, and closes the subquery bypass vector. The patched release is available at https://github.com/nocobase/nocobase/releases/tag/v2.1.0-alpha.46; the specific fix commit is https://github.com/nocobase/nocobase/commit/87c548969ce9258dd7f0d9571c9453ae10bc3fc4. If an immediate upgrade is not possible, disable the @nocobase/plugin-collection-sql plugin entirely - this removes the attack surface at the cost of SQL-backed collection functionality. As a partial mitigation, audit all existing SQL Collection definitions for references to pg_shadow, pg_roles, pg_stat_activity, information_schema, or subqueries that alias these tables, and delete any offending collections. Organizations with strict security requirements should note that blocklist-based SQL validation is inherently fragile against novel bypass patterns; consider restricting the PostgreSQL role used by NocoBase to a least-privilege account that cannot read pg_shadow even if a bypass is discovered.