Server-Side Request Forgery in NocoBase

Executive Summary

CVE-2026-58468 is a Server-Side Request Forgery (SSRF) vulnerability in NocoBase versions through 2.1.20. It exists in the serverRequest wrapper, which is used by workflow request nodes, custom request action buttons, and the AI plugin. Authenticated administrators can exploit this vulnerability by supplying malicious URLs that cause the server to make arbitrary outbound HTTP requests.

Because the SERVER_REQUEST_WHITELIST environment variable is not configured by default, outbound HTTP requests are unrestricted. This allows attackers to target internal network addresses such as loopback, RFC-1918 private ranges, and cloud instance metadata endpoints.

Exploitation can lead to internal network port enumeration, host discovery, and theft of IAM role credentials from cloud metadata services, potentially compromising cloud accounts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have several impacts if exploited:

• Attackers with administrator access can perform internal network port scanning and host discovery.
• They can access sensitive cloud instance metadata endpoints, potentially stealing IAM role credentials.
• Credential theft can lead to full compromise of cloud accounts and associated resources.
• Unrestricted outbound HTTP requests can expose internal network structure and services to attackers.

Useful 0 Not Useful 0

Detection Guidance

Detection of this SSRF vulnerability involves monitoring for unusual outbound HTTP requests initiated by authenticated administrators through workflow request nodes, custom request buttons, or the AI plugin. Specifically, look for POST requests to the endpoint /api/flow_nodes:test with URLs targeting internal IP ranges such as loopback addresses (127.0.0.1), RFC-1918 private ranges, or cloud metadata service IPs (e.g., 169.254.169.254).

Since the vulnerability allows arbitrary outbound HTTP requests, network monitoring tools or web server logs can be used to detect suspicious requests. Commands to check logs or monitor network traffic might include:

• Using grep to find suspicious POST requests in server logs: grep "/api/flow_nodes:test" /path/to/nocobase/logs/access.log
• Using tcpdump or similar to monitor outbound HTTP requests to internal IP ranges: sudo tcpdump -i any tcp and dst net 127.0.0.0/8 or dst net 10.0.0.0/8 or dst net 172.16.0.0/12 or dst net 192.168.0.0/16
• Checking for warning logs related to SSRF risk if SERVER_REQUEST_WHITELIST is not configured, as the system logs warnings for requests targeting risky internal or metadata addresses.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include configuring the SERVER_REQUEST_WHITELIST environment variable to restrict outbound HTTP requests only to trusted domains or IP ranges. This whitelist blocks requests to loopback, private, link-local, and cloud metadata addresses by default, preventing exploitation of the SSRF vulnerability.

If you rely on internal services, explicitly add their IPs or domains to the whitelist to avoid disruption. Additionally, update NocoBase to a version that includes the patch or apply the relevant pull request that introduces these restrictions and warning mechanisms.

Other recommended actions include monitoring logs for SSRF warning messages, restricting administrator access to trusted users only, and reviewing workflow nodes, custom request buttons, and AI plugin configurations to ensure they do not accept untrusted URLs.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated administrators to perform Server-Side Request Forgery (SSRF), enabling them to send arbitrary outbound HTTP requests to internal network addresses and cloud metadata endpoints.

This can lead to internal network port enumeration, host discovery, and theft of IAM role credentials from cloud instance metadata services, potentially resulting in unauthorized access to sensitive data or cloud resources.

Such unauthorized access and potential data exposure could negatively impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive personal and health information and mandate strict access controls and data security measures.

Therefore, exploitation of this vulnerability may lead to violations of these regulations due to compromised confidentiality and integrity of protected data.

Useful 0 Not Useful 0