NocoBase CVE-2026-58468

Exploitation requires an authenticated session with NocoBase administrator-level privileges - the attack cannot be performed by unauthenticated users or lower-privilege roles. The attacker must have access to at least one of three specific features: workflow automation request nodes, custom request action buttons, or the AI plugin, all of which invoke the vulnerable serverRequest wrapper. Maximum impact (IAM credential theft) further requires that the NocoBase server is deployed in a cloud environment with an instance metadata service accessible at the standard link-local address (169.254.169.254 for AWS/Azure/GCP IMDSv1) and that IMDSv2 hop-limit enforcement is not in place. Internal network enumeration impact requires network adjacency between the NocoBase server and target RFC-1918 hosts. The SERVER_REQUEST_WHITELIST configuration, if set, restricts allowable outbound destinations and limits exploitation to whitelisted domains. Deployments where admin access is tightly controlled and cloud metadata is inaccessible from the application host are at materially lower risk.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, score 5.1) accurately captures that exploitation requires high-privilege authentication, which is the primary limiting factor. However, the supplied impact metrics (VC:N/VI:L/SC:L) appear to underestimate the confidentiality impact: retrieval of IAM role credentials from a cloud metadata service (e.g., AWS IMDSv1) can yield long-lived cloud credentials enabling full account compromise of the hosting environment - a subsequent-system confidentiality impact that should register as high. The PR:H requirement means this is not mass-exploitable against default internet-facing instances, but the risk profile changes dramatically in multi-tenant SaaS contexts, compromised-admin scenarios, or insider threat models. A publicly available POC (GitHub issue #9962 via VulnCheck) lowers the exploitation bar for any attacker already holding admin credentials. EPSS data was not provided; absent KEV listing, widespread automated exploitation is not confirmed. The SSRF-to-cloud-metadata path is the most dangerous consequence and should drive remediation priority for cloud-hosted NocoBase deployments.

An attacker who has obtained NocoBase administrator credentials - through phishing, credential stuffing, or insider access - creates a workflow request node or custom action button supplying the URL http://169.254.169.254/latest/meta-data/iam/security-credentials/ as the target. The NocoBase server fetches this URL from its own network context, returning the list of attached IAM roles; a follow-up request to the role-specific endpoint yields temporary AWS access key, secret, and session token, granting the attacker cloud-level privileges. A publicly available POC (GitHub issue #9962) demonstrates this technique, lowering the skill barrier for any attacker already in the admin role.