Read the docs
TI-2026-29121 Aliases CVE-2026-40346GHSA-mvvv-v22x-xqwp

NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins

Priority MEDIUM 62CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.37, NocoBase's workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An authenticated user can access internal network services, cloud metadata endpoints, and localhost. Version 2.0.37 contains a patch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00384 32nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed @nocobase/plugin-workflow-request (nocobase): 2.0.37@nocobase/plugin-workflow-request (npm): 2.0.37

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nocobase@nocobase/plugin-workflow-requestbefore 2.0.372.0.37Patch availableCNA
—@nocobase/plugin-workflow-request (npm)before 2.0.372.0.37Patch availableGHSA-mvvv-v22x-xqwp
  • @nocobase/plugin-workflow-request Vendornocobase Affected before 2.0.37 Fixed in 2.0.37 Patch available CNA
  • @nocobase/plugin-workflow-request (npm) Vendor— Affected before 2.0.37 Fixed in 2.0.37 Patch available GHSA-mvvv-v22x-xqwp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nocobase:nocobase:*:*:*:*:*:*:*:*before 2.0.37Vulnerablenocobase
  • cpe:2.3:a:nocobase:nocobase:*:*:*:*:*:*:*:* Versions before 2.0.37 Vulnerable ·nocobase

Remediation

  • Fix · CNA @nocobase/plugin-workflow-request (nocobase) Fixed in 2.0.37
  • Fix · GHSA-mvvv-v22x-xqwp @nocobase/plugin-workflow-request (npm) Fixed in 2.0.37 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40346
  2. 2026-10-03 Alias added: GHSA-mvvv-v22x-xqwp

References

Exploit 2

Patch 1

Advisory 1

Other 2

  • TI-2026-26457 NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node CVSS 3.1CRITICAL 10.0
  • TI-2026-27069 NocoBase Has SQL Injection via template variable substitution in workflow SQL node CVSS 4.0HIGH 8.5
  • TI-2026-30159 NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading CVSS 3.1HIGH 8.8
  • TI-2026-30160 NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences