CVE-2026-58468: NocoBase 2.1.20 Server-Side Request Forgery via serverRequest wrapper
NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows authenticated administrators to issue arbitrary outbound HTTP requests by supplying malicious URLs to workflow request nodes, custom request action buttons, or the AI plugin. Attackers can target loopback addresses, RFC-1918 private ranges, and cloud instance metadata endpoints to perform internal network port enumeration, host discovery, and retrieval of IAM role credentials from the instance metadata service. v2.1.18 added a warning message for when SERVERREQUESTWHITELIST is not configured.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NocoBaseto a version that resolves this vulnerability.Fixed in 2.1.20 - Configuration
Configure SERVER_REQUEST_WHITELIST to restrict outbound requests; v2.1.18 added a warning message when SERVER_REQUEST_WHITELIST is not configured.
NocoBase serverRequest wrapper SERVER_REQUEST_WHITELIST = configured
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58468?
CVE-2026-58468 has a medium severity rating of 5.5.
What is the nature of the vulnerability described in CVE-2026-58468?
CVE-2026-58468 is a server-side request forgery (SSRF) vulnerability in the NocoBase serverRequest wrapper.
Who is affected by CVE-2026-58468?
Authenticated administrators using NocoBase versions through 2.1.20 are affected by CVE-2026-58468.
How do I fix CVE-2026-58468?
To fix CVE-2026-58468, upgrade NocoBase to the latest version that addresses this vulnerability.
What are the potential impacts of CVE-2026-58468 on an application?
CVE-2026-58468 can allow authenticated administrators to issue arbitrary outbound HTTP requests, leading to potential data exposure or further attacks.