CVE-2026-40346
CVE-2026-40346 · NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.37, NocoBase's workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An authenticated user can access internal network services, cloud metadata endpoints, and localhost. Version 2.0.37 contains a patch.
CVSS 6.4 · Media · EPSS 0,4% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
@nocobase/plugin-workflow-request
- Versiones
- < 2.0.37: Afectada
Sin corrección publicada
@nocobase/plugin-workflow-request npm
- Intervalos de versiones afectados
- SEMVER: < 2.0.37
Actualiza a 2.0.37
Fuentes originales
- https://github.com/nocobase/nocobase/security/advisories/GHSA-mvvv-v22x-xqwp
- https://github.com/nocobase/nocobase/pull/9079
- https://github.com/nocobase/nocobase/commit/2853368243ed07339c62c548b7d475f4eeaada59
- https://github.com/nocobase/nocobase/releases/tag/v2.0.37
- https://nvd.nist.gov/vuln/detail/CVE-2026-40346