EUVD-2026-42076
GHSA-mcxg-3vgg-9774
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin authentication (PR:H) required; scope changes to cloud/internal systems (S:C) with high confidentiality impact from IAM credential retrieval (C:H).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows authenticated administrators to issue arbitrary outbound HTTP requests by supplying malicious URLs to workflow request nodes, custom request action buttons, or the AI plugin. Attackers can target loopback addresses, RFC-1918 private ranges, and cloud instance metadata endpoints to perform internal network port enumeration, host discovery, and retrieval of IAM role credentials from the instance metadata service. v2.1.18 added a warning message for when SERVER_REQUEST_WHITELIST is not configured.
AnalysisAI
Server-side request forgery in NocoBase through v2.1.20 allows authenticated administrators to issue arbitrary outbound HTTP requests via the serverRequest wrapper, enabling internal network enumeration and cloud instance metadata exfiltration. The attack surface spans workflow request nodes, custom request action buttons, and the AI plugin - all of which accept administrator-supplied URLs without adequate server-side validation. A publicly available proof-of-concept exists per VulnCheck reporting; no CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis, though the IAM credential theft potential elevates real-world impact significantly for cloud-hosted deployments.
Technical ContextAI
NocoBase is an open-source no-code/low-code platform (CPE: cpe:2.3:a:nocobase:nocobase:*:*:*:*:*:*:*:*) that exposes a serverRequest wrapper used by multiple product features including workflow automation, UI action buttons, and the AI plugin. CWE-918 (Server-Side Request Forgery) describes the root cause: the server fetches attacker-controlled URLs without validating or restricting the destination, allowing it to reach resources inaccessible directly from the attacker's network. Critically, RFC-1918 private ranges (10.x, 172.16-31.x, 192.168.x), loopback (127.0.0.1), and cloud instance metadata endpoints (e.g., 169.254.169.254 for AWS IMDSv1, Azure IMDS) are reachable via this pathway. NocoBase v2.1.18 introduced a warning when SERVER_REQUEST_WHITELIST is not configured, acknowledging the absence of a default-deny allowlist - but did not enforce one, leaving deployments through 2.1.20 exposed.
RemediationAI
Apply the upstream fix by pulling the commit 5706fb48d9bbe190f9e0044c6d5c87fc5b68c7f1 from https://github.com/nocobase/nocobase/commit/5706fb48d9bbe190f9e0044c6d5c87fc5b68c7f1 or tracking PR #9966 at https://github.com/nocobase/nocobase/pull/9966; a formally versioned patched release is not independently confirmed, so verify release notes for a version beyond 2.1.20. As an immediate compensating control, configure SERVER_REQUEST_WHITELIST (a configuration option whose absence triggers a warning as of v2.1.18) to a strict allowlist of legitimate external domains required by workflows - this prevents access to loopback, RFC-1918, and metadata addresses. If the AI plugin or outbound workflow request features are not operationally required, disable them to eliminate the attack surface with no functional trade-off for deployments not using these features. For cloud-hosted instances, enabling IMDSv2 on AWS EC2 (requiring a session-oriented token rather than a simple GET request) prevents metadata credential theft via basic SSRF, as NocoBase's serverRequest wrapper is unlikely to handle the IMDSv2 token exchange. Restrict outbound network access from the NocoBase server at the firewall or cloud security group level to block connections to 169.254.169.254, 169.254.170.2, and RFC-1918 ranges if internal network access is not needed.
SQL injection in NocoBase's @nocobase/plugin-notification-in-app-message (before 2.0.61) lets any signed-up authenticate
PostgreSQL password hash disclosure in NocoBase 2.0.59 and earlier allows an authenticated administrator to extract pg_s
Command injection in NocoBase's @nocobase/plugin-backups prior to v2.1.19 allows an authenticated backup-management user
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today