CVE-2026-125397 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
The NocoBase plugin-ai versions 2.1.0 through 2.2.41 fail to check role assignments when listing AI employees, so an authenticated user can supply a username to override the filter. An attacker can then run AI employees they were never granted, with their tools and permissions, and read their prompts and tool configuration.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted or managed NocoBase deployments running plugin-ai from 2.1.0 through 2.2.41 where authenticated users have accounts. Deployments without the AI plugin, or on versions outside that range, are not affected by this flaw.
Not affected if plugin-ai-not-installed, version-outside-range
Who cares nocobase, plugin-ai, self-hosted
@nocobase/plugin-ai version in the NocoBase project's package.json or lockfile; versions 2.1.0 through 2.2.41 are affected.@nocobase/plugin-ai: move to a version later than 2.2.41 (the sources do not name the exact fixed release; see the linked patch).NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee() that lets authenticated users access unassigned AI employees by overriding the role-derived filter with a supplied username. Attackers can use the dispatch-sub-agent-task tool to run ungranted AI employees with their tools and permissions, and get-ai-employee to read their prompts and tool configuration.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.