CVE-2026-58468

Name of the Vulnerable Software and Affected Versions NocoBase versions prior to 2.1.21

Description A server-side request forgery (SSRF) issue exists in the serverRequest wrapper. This allows authenticated administrators to execute arbitrary outbound HTTP requests by providing malicious URLs to workflow request nodes, custom request action buttons, or the AI plugin. This can be used to target loopback addresses, RFC-1918 private ranges, and cloud instance metadata endpoints to conduct internal network port enumeration, host discovery, and retrieve IAM role credentials from the instance metadata service.

Recommendations Update to a version newer than 2.1.20. Configure the SERVER REQUEST WHITELIST to restrict outbound requests.