CVE-2026-79914

Name of the Vulnerable Software and Affected Versions NocoBase versions 2.1.0 through 2.1.14

Description An issue exists in the @nocobase/plugin-action-custom-request plugin where a low-privileged authenticated user can perform a Server-Side Request Forgery (SSRF). By calling the customRequests:send endpoint, an attacker can override the stored request URL at runtime using the options.url variable. This allows the server to be used as a trusted network proxy to send outbound HTTP requests to internal destinations, Docker host gateways, or cloud metadata endpoints, potentially exposing internal services.

Recommendations Update NocoBase to version 2.1.15. As a temporary mitigation, restrict access to the customRequests:send endpoint to administrators only. Configure the SERVER REQUEST WHITELIST environment variable to limit allowed outbound request destinations.