Server-Side Request Forgery in NocoBase by NocoBase
CVE-2026-58468
Key Information:
Badges
What is CVE-2026-58468?
NocoBase, up to version 2.1.20, exhibits a server-side request forgery vulnerability within the serverRequest wrapper. This flaw permits authenticated administrators to make unauthorized outbound HTTP requests by inputting malicious URL links into workflow request nodes, custom action buttons, or plugins utilizing AI. Exploiting this vulnerability enables attackers to target local addresses, private IP ranges defined by RFC-1918, and cloud metadata services, which can facilitate internal network scans, host discovery, and unauthorized access to IAM role credentials from the affected instance metadata service. Additionally, version 2.1.18 introduced a notification for cases where SERVER_REQUEST_WHITELIST remains unconfigured, but this does not mitigate the inherent risks.
Affected Version(s)
nocobase 0 <= 2.1.20
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved