Dashboard / CVE-2026-58468

CVE-2026-58468

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 55/100
Published: 2026-07-07 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: None
AT: None
VC: None
VI: Low
VA: None

Description

NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows authenticated administrators to issue arbitrary outbound HTTP requests by supplying malicious URLs to workflow request nodes, custom request action buttons, or the AI plugin. Attackers can target loopback addresses, RFC-1918 private ranges, and cloud instance metadata endpoints to perform internal network port enumeration, host discovery, and retrieval of IAM role credentials from the instance metadata service. v2.1.18 added a warning message for when SERVER_REQUEST_WHITELIST is not configured.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
nocobase nocobase 0

References & Advisories (4)

https://github.com/nocobase/nocobase/issues/9962
technical-description exploit issue-tracking

Bug Bounty Relevance

55 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

5.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N

EPSS — Exploitation Probability

0.34%
Raw Score 0.003370
Percentile 27.4%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00337
2026-11-12
0.00337
2026-11-10
0.00337
2026-11-09
0.00337
2026-11-08
0.00337

Intelligence Sources

mitre ref →

External Links