---
id: CVE-2026-58468
title: NocoBase 2.1.20 Server-Side Request Forgery via serverRequest wrapper
summary: >-
  NocoBase through 2.1.20 contains a server-side request forgery vulnerability
  in the serverRequest wrapper that allows authenticated administrators to issue
  arbitrary outbound HTTP requests by supplying malicious URLs to workflow
  request …
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: nocobase
product: nocobase
affected:
  - nocobase <= 2.1.20
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-08T16:48:33.586731Z'
exploitAvailable: true
published: '2026-07-07'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:07:07.162Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-58468'
references:
  - url: 'https://github.com/nocobase/nocobase/issues/9962'
    label: Researcher Disclosure
  - url: 'https://github.com/nocobase/nocobase/pull/9966'
    label: Mitigation PR
  - url: >-
      https://github.com/nocobase/nocobase/commit/5706fb48d9bbe190f9e0044c6d5c87fc5b68c7f1
    label: Mitigation Commit
  - url: >-
      https://www.vulncheck.com/advisories/nocobase-server-side-request-forgery-via-serverrequest-wrapper
tags:
  - cve.org
  - exploit-available
epss: 0.00337
epssPercentile: 0.27222
ingestedAt: '2026-11-08T14:51:22.291Z'
---

## Overview

NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows authenticated administrators to issue arbitrary outbound HTTP requests by supplying malicious URLs to workflow request nodes, custom request action buttons, or the AI plugin. Attackers can target loopback addresses, RFC-1918 private ranges, and cloud instance metadata endpoints to perform internal network port enumeration, host discovery, and retrieval of IAM role credentials from the instance metadata service. v2.1.18 added a warning message for when SERVER_REQUEST_WHITELIST is not configured.

## Affected

- `nocobase <= 2.1.20`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.