CVE-2026-40346: NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins
(updated )
NocoBase’s workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An authenticated user can access internal network services, cloud metadata endpoints, and localhost.
References
- github.com/advisories/GHSA-mvvv-v22x-xqwp
- github.com/nocobase/nocobase/commit/2853368243ed07339c62c548b7d475f4eeaada59
- github.com/nocobase/nocobase/pull/9079
- github.com/nocobase/nocobase/releases/tag/v2.0.37
- github.com/nocobase/nocobase/security/advisories/GHSA-mvvv-v22x-xqwp
- nvd.nist.gov/vuln/detail/CVE-2026-40346
Code Behaviors & Features
Detect and mitigate CVE-2026-40346 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →