Server-Side Request Forgery in NocoBase AI Platform
CVE-2026-79914

4.3MEDIUM

Key Information:

Vendor

Nocobase

Status
Nocobase
Vendor
CVE Published:
10 November 2026

What is CVE-2026-79914?

The NocoBase platform, an AI-driven no-code/low-code solution for creating business applications, has a significant server-side request forgery vulnerability present in versions 2.1.0 to 2.1.14. Specifically, the issue lies within the customRequests:send endpoint, where a low-privileged authenticated user can manipulate the stored request URL during runtime. This allows the server to make requests to attacker-controlled domains or sensitive internal resources. As a result, exploitation of this vulnerability can lead to the exposure of essential internal services, Docker host gateways, and cloud metadata endpoints, potentially permitting attackers to use the server as a trusted network proxy. This vulnerability has been addressed in version 2.1.15.

Affected Version(s)

nocobase >= 2.1.0, < 2.1.15

References

https://github.com/nocobase/nocobase/security/advisories/...
x_refsource_CONFIRM
https://github.com/nocobase/nocobase/commit/037dade8592fb...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.