PT-2026-33211 · Nocobase · Nocobase

Published 2026-04-15 · Updated 2026-05-13 · CVE-2026-40346

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NocoBase versions prior to 2.0.37

Description The workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without protection against Server-Side Request Forgery (SSRF), a flaw where an attacker forces a server to make requests to an unintended location. An authenticated user can access internal network services, localhost, and cloud metadata endpoints, potentially leading to the theft of cloud credentials (such as AWS, GCP, or Azure) or interaction with private services like PostgreSQL and Redis. The issue exists because the url variable is used without validation or filtering of private IP ranges and DNS rebinding protection.

Recommendations Update to version 2.0.37. As a temporary workaround, restrict access to the workflow HTTP request plugin and the custom request action plugin to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-40346

GHSA-MVVV-V22X-XQWP

Affected Products

Nocobase

References · 10

• https://github.com/nocobase/nocobase/security/advisories/GHSA-mvvv-v22x-xqwp · Vendor Advisory
• https://github.com/nocobase/nocobase/pull/9079 · Patch
• https://github.com/nocobase/nocobase/commit/2853368243ed07339c62c548b7d475f4eeaada59 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40346 · Security Note
• https://osv.dev/vulnerability/GHSA-mvvv-v22x-xqwp · Vendor Advisory
• https://github.com/nocobase/nocobase/releases/tag/v2.0.37 · Note
• https://github.com/nocobase/nocobase · Note
• https://twitter.com/VulmonFeeds/status/2045332282907459798 · Twitter Post
• https://t.me/cveNotify/163370 · Telegram Post
• https://twitter.com/CVEnew/status/2045467346324619676 · Twitter Post