CVE-2026-79914 · Other
NO FIX YET · SEE WHAT TO DO
NocoBase versions 2.1.0 through 2.1.14 let an authenticated low-privileged user override the stored request URL on the customRequests:send endpoint. The server then sends requests to attacker-chosen destinations, which can reach internal services, Docker host gateways, or cloud metadata endpoints.
first public Oct 14, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running self-hosted NocoBase 2.1.0 through 2.1.14 where some users have accounts with low privileges. The request path is the customRequests:send endpoint, and the risk is server-side request forgery from inside the network. Deployments on versions 2.1.15 or later are not affected.
Not affected if no-customrequests-use, version-2.1.15-or-later
Who cares cloud, nocobase, self-hosted
2.1.0 through 2.1.14.2.1.15NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Versions 2.1.0 through 2.1.14 contain a server-side request forgery vulnerability in the customRequests:send endpoint. A low-privileged authenticated user can override the stored request URL at runtime using options.url, causing the NocoBase server to send requests to attacker-controlled or internal destinations. Exploitation could expose internal services, Docker host gateways, or cloud metadata endpoints and allow the server to be used as a trusted network proxy. This issue has been fixed in version 2.1.15.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.