CVE-2026-58468: NocoBase SSRF Vulnerability – Admin-Only Cloud Credential Risk

Technical summary

The vulnerability stems from insufficient URL validation in the serverRequest wrapper component that processes HTTP requests initiated through workflow automation, custom action buttons, and AI plugin features. The application fails to adequately restrict outbound requests to trusted endpoints, permitting requests to loopback interfaces (127.0.0.1), RFC-1918 private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and cloud metadata services (169.254.169.254 for AWS, GCP metadata endpoints, etc.). An admin can craft URLs targeting these internal resources to enumerate network topology, discover listening services, and access credential endpoints. The issue was partially acknowledged in v2.1.18 with a warning message when SERVER_REQUEST_WHITELIST configuration is absent, but the underlying validation logic remains insufficient.

Business impact

In cloud-native deployments, this vulnerability enables credential exfiltration from instance metadata services, potentially granting attackers temporary AWS STS tokens, GCP service account keys, or equivalent cloud credentials with the permissions of the compromised instance. In hybrid or on-premises environments, it facilitates internal network reconnaissance and lateral movement to systems assumed to be isolated from external threats. For organizations using NocoBase as a data integration hub or workflow automation platform, a compromised admin account becomes a vector for supply-chain-style attacks—malicious workflows can silently query internal databases, APIs, and credential stores. The CVSS score of 5.5 reflects that exploitation requires admin privileges, but the scope of potential damage (especially in cloud) is material.

Affected systems

NocoBase versions through 2.1.20 are affected. The vulnerability is present in any deployment where the serverRequest wrapper is used—specifically workflow automation features, custom request action buttons, and the AI plugin module. Deployments with auth-protected admin interfaces and internet-facing NocoBase instances face elevated risk. Organizations running earlier versions should verify their current version and upgrade path; note that v2.1.18 introduced a configuration warning but did not fully remediate the validation issue.

Exploitability

Exploitation requires authenticated admin-level credentials, which significantly limits attack surface in well-governed environments. However, admin compromise—via phishing, credential stuffing, insider threat, or lateral movement—is not uncommon. Once an admin is compromised, exploitation is trivial: no user interaction is required, and the attacker can immediately construct workflow nodes or request buttons pointing to internal metadata endpoints or private services. Proof-of-concept is straightforward and requires only knowledge of internal network topology or cloud metadata endpoint conventions. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities catalog, but the simplicity of exploitation and high value of cloud credentials make it an attractive target post-compromise.

Remediation

Upgrade NocoBase to a version that implements strict URL whitelist validation in the serverRequest wrapper. Verify that the patch includes a deny-by-default approach: only explicitly whitelisted hostnames, IP ranges, or domains should be reachable via workflow and action requests. Ensure the SERVER_REQUEST_WHITELIST configuration is mandatory and enforced. As an interim mitigation, restrict admin role membership to a minimal set of trusted users, enforce multi-factor authentication on admin accounts, monitor workflow definitions and custom action buttons for suspicious URL patterns, and implement network-level controls (WAF, egress filtering, security groups) to block outbound requests from the NocoBase container/instance to 169.254.169.254 and private RFC-1918 ranges unless explicitly required.

Patch guidance

Monitor the official NocoBase GitHub releases and security advisories for a patched version that addresses URL validation in the serverRequest wrapper. The vendor should provide explicit guidance on which version number resolves this issue. Apply patches promptly to production environments, prioritizing systems with internet-facing admin interfaces or cloud deployments where metadata endpoint access is possible. Test patches in a staging environment to ensure workflow and action button functionality remains intact. After patching, audit existing workflows and custom actions to remove any suspicious request URLs and verify that SERVER_REQUEST_WHITELIST is properly configured.

Detection guidance

Monitor NocoBase application logs for workflow execution and custom action invocations; flag requests to loopback (127.0.0.1, ::1), private IP ranges (10.*, 172.16.*, 192.168.*), and cloud metadata endpoints (169.254.169.254, metadata.google.internal, etc.). Alert on unusual outbound HTTP/HTTPS traffic from the NocoBase instance to internal services or metadata endpoints, especially if it originates from workflow or action button components. Review workflow definitions and custom action button configurations in the database or configuration files for hardcoded internal URLs or metadata endpoint patterns. Monitor IAM credential issuance and usage: a spike in temporary credential requests from NocoBase-associated service accounts may indicate active exploitation. Correlate with admin login events to identify potential compromise vectors.

Why prioritize this

Although the CVSS score is medium (5.5) due to the admin-only requirement, the real-world impact is high in cloud environments where metadata endpoint access yields valuable credentials. Organizations running NocoBase in AWS, GCP, or Azure should prioritize patching to prevent credential exfiltration. For on-premises deployments, the priority is lower unless NocoBase has legitimate need to access internal services, in which case the whitelist misconfiguration still poses a lateral movement risk. Prioritize any instance where the admin user base includes contractors, service accounts, or third-party integrations.

Risk score, explained

CVSS 3.1 score of 5.5 (MEDIUM) reflects: Network-based attack vector (no physical access required), low attack complexity (straightforward URL injection), high privilege requirement (admin auth), no user interaction needed, and changed scope (can reach systems outside the intended security boundary). The score does not fully capture the business risk in cloud deployments, where credential theft is high-impact; organizations should treat this as MEDIUM-to-HIGH priority in cloud-native environments and MEDIUM in on-premises settings.

Frequently asked questions