Every CVE Search/ Get API key

CVE-2026-40346

NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins

6.4 MediumFix available

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.37, NocoBase's workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An authenticated user can access internal network services, cloud metadata endpoints, and localhost. Version 2.0.37 contains a patch.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
None

Exploit likelihood

0.38%Up 0.3 points since Apr 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.4

NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.37, NocoBase's workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An authenticated user can access internal network services, cloud metadata endpoints, and localhost. Version 2.0.37 contains a patch.

Record
CVE-2026-40346
CVSS 4.0
6.4 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Weakness
CWE-918
Updated
2026-11-02
EUVDEUVD-2026-23613 6.4

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.37, NocoBase's workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An authenticated user can access internal network services, cloud metadata endpoints, and localhost. Version 2.0.37 contains a patch.

Record
EUVD-2026-23613
CVSS 4.0
6.4 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-mvvv-v22x-xqwp 6.4

NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins

Summary

NocoBase's workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An authenticated user can access internal network services, cloud metadata endpoints, and localhost.

Vulnerable Code

1. Workflow HTTP Request Plugin

packages/plugins/@nocobase/plugin-workflow-request/src/server/RequestInstruction.ts lines 117-128:

return axios.request({
  url: trim(url),  // User-controlled, no validation
  method,
  headers,
  params,
  timeout,
  ...(method.toLowerCase() !== 'get' && data != null
    ? { data: transformer ? await transformer(data) : data }
    : {}),
});

The url at line 98 comes directly from user workflow configuration with only whitespace trimming.

2. Custom Request Action Plugin

packages/plugins/@nocobase/plugin-action-custom-request/src/server/actions/send.ts lines 172-198:

const axiosRequestConfig = {
  baseURL: ctx.origin,
  ...options,
  url: getParsedValue(url, variables),  // User-controlled via template
  headers: { ... },
  params: getParsedValue(arrayToObject(params), variables),
  data: getParsedValue(toJSON(data), variables),
};
const res = await axios(axiosRequestConfig);  // No IP validation

Missing Protections

  • No request-filtering-agent or SSRF library (confirmed via grep across entire codebase)
  • No private IP range filtering
  • No cloud metadata endpoint blocking
  • No URL scheme validation
  • No DNS rebinding protection

Attack Scenario

  1. Authenticated user creates a workflow with HTTP Request node
  2. Sets URL to http://169.254.169.254/latest/meta-data/iam/security-credentials/
  3. Triggers the workflow
  4. Server fetches AWS metadata and returns IAM credentials in workflow execution logs

Alternatively via Custom Request action:

  1. Create custom request with URL http://127.0.0.1:5432 or http://10.0.0.1:8080/admin
  2. Execute the action
  3. Server makes request to internal service

Impact

  • Cloud metadata theft: AWS/GCP/Azure credentials via metadata endpoints
  • Internal network access: Scan and interact with services on private IP ranges
  • Database access: Connect to localhost databases (PostgreSQL, Redis, etc.)
  • Authentication required: Yes (authenticated user), but any workspace member can create workflows
Record
GHSA-mvvv-v22x-xqwp
CVSS 4.0
6.4 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
NVD 6.4

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.37, NocoBase's workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An authenticated user can access internal network services, cloud metadata endpoints, and localhost. Version 2.0.37 contains a patch.

Record
CVE-2026-40346
CVSS 4.0
6.4 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
OSV 6.4

NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.37, NocoBase's workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An authenticated user can access internal network services, cloud metadata endpoints, and localhost. Version 2.0.37 contains a patch.

Record
CVE-2026-40346
CVSS 4.0
6.4 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Weakness
CWE-918
Updated
2026-11-02
OSVGHSA-mvvv-v22x-xqwp 6.4

NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins

Summary

NocoBase's workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An authenticated user can access internal network services, cloud metadata endpoints, and localhost.

Vulnerable Code

1. Workflow HTTP Request Plugin

packages/plugins/@nocobase/plugin-workflow-request/src/server/RequestInstruction.ts lines 117-128:

return axios.request({
  url: trim(url),  // User-controlled, no validation
  method,
  headers,
  params,
  timeout,
  ...(method.toLowerCase() !== 'get' && data != null
    ? { data: transformer ? await transformer(data) : data }
    : {}),
});

The url at line 98 comes directly from user workflow configuration with only whitespace trimming.

2. Custom Request Action Plugin

packages/plugins/@nocobase/plugin-action-custom-request/src/server/actions/send.ts lines 172-198:

const axiosRequestConfig = {
  baseURL: ctx.origin,
  ...options,
  url: getParsedValue(url, variables),  // User-controlled via template
  headers: { ... },
  params: getParsedValue(arrayToObject(params), variables),
  data: getParsedValue(toJSON(data), variables),
};
const res = await axios(axiosRequestConfig);  // No IP validation

Missing Protections

  • No request-filtering-agent or SSRF library (confirmed via grep across entire codebase)
  • No private IP range filtering
  • No cloud metadata endpoint blocking
  • No URL scheme validation
  • No DNS rebinding protection

Attack Scenario

  1. Authenticated user creates a workflow with HTTP Request node
  2. Sets URL to http://169.254.169.254/latest/meta-data/iam/security-credentials/
  3. Triggers the workflow
  4. Server fetches AWS metadata and returns IAM credentials in workflow execution logs

Alternatively via Custom Request action:

  1. Create custom request with URL http://127.0.0.1:5432 or http://10.0.0.1:8080/admin
  2. Execute the action
  3. Server makes request to internal service

Impact

  • Cloud metadata theft: AWS/GCP/Azure credentials via metadata endpoints
  • Internal network access: Scan and interact with services on private IP ranges
  • Database access: Connect to localhost databases (PostgreSQL, Redis, etc.)
  • Authentication required: Yes (authenticated user), but any workspace member can create workflows
Record
GHSA-mvvv-v22x-xqwp
CVSS 4.0
6.4 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
@nocobase/plugin-workflow-request
npm
 before 2.0.37
2.0.37

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-40346 is a medium vulnerability (CVSS 6.4) in Nocobase, published April 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in @nocobase/plugin-workflow-request 2.0.37.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open