CVE-2026-40346CWE-918

NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins

Medium · published April 17, 2026

CVSS v4.0
6.4
EPSS
0%
Percentile
36.1
In the wild
Unconfirmed
What it is

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.37, NocoBase's workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An authenticated user can access internal network services, cloud metadata endpoints, and localhost. Version 2.0.37 contains a patch.

The record
Technical detail
CVSS v4.0
6.4 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
EPSS
0.00429 · 36.1th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-04-17T23:54Z
EPSS history
Timeline
  • 17 APR 23:54Z
    NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins
    cvelistv5