{"id":"EUVD-2026-23613","enisaUuid":"2718d8a5-c4c3-3859-94d6-46ca1bfdd09a","description":"NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.37, NocoBase\u0027s workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An authenticated user can access internal network services, cloud metadata endpoints, and localhost. Version 2.0.37 contains a patch.","datePublished":"Apr 17, 2026, 11:54:34 PM","dateUpdated":"Apr 20, 2026, 2:56:12 PM","baseScore":6.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","references":"https://github.com/nocobase/nocobase/security/advisories/GHSA-mvvv-v22x-xqwp\nhttps://github.com/nocobase/nocobase/pull/9079\nhttps://github.com/nocobase/nocobase/commit/2853368243ed07339c62c548b7d475f4eeaada59\nhttps://github.com/nocobase/nocobase/releases/tag/v2.0.37\n","aliases":"CVE-2026-40346\nGHSA-mvvv-v22x-xqwp\n","assigner":"GitHub_M","epss":0.38,"enisaIdProduct":[{"id":"8fa9672a-f9c9-390a-9e65-1ffdcf869458","product":{"name":"@nocobase/plugin-workflow-request","vendor":{"name":"nocobase"}},"product_version":"\u003c 2.0.37"}],"enisaIdVendor":[{"id":"8c675346-4a07-3d0a-beea-1354cd41e842","vendor":{"name":"nocobase"}}],"enisaIdVulnerability":[{"id":"10dbc335-9132-3737-8264-36d2ca5bc813","vulnerability":{"id":"GHSA-mvvv-v22x-xqwp","description":"NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins","datePublished":"Apr 15, 2026, 7:43:50 PM","dateUpdated":"May 14, 2026, 8:39:05 PM","baseScore":0.0,"references":"https://github.com/nocobase/nocobase/security/advisories/GHSA-mvvv-v22x-xqwp\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40346\nhttps://github.com/nocobase/nocobase/pull/9079\nhttps://github.com/nocobase/nocobase/commit/2853368243ed07339c62c548b7d475f4eeaada59\nhttps://github.com/nocobase/nocobase\nhttps://github.com/nocobase/nocobase/releases/tag/v2.0.37\n","enisa_id":"EUVD-2026-23613\n","aliases":"GHSA-mvvv-v22x-xqwp\nCVE-2026-40346\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"fb9ac9d2-9926-3a6d-b83b-e9bd11ec4308","vulnerability":{"id":"CVE-2026-40346","description":"NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.37, NocoBase\u0027s workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An authenticated user can access internal network services, cloud metadata endpoints, and localhost. Version 2.0.37 contains a patch.","datePublished":"Apr 17, 2026, 11:54:34 PM","dateUpdated":"Apr 20, 2026, 2:56:12 PM","status":"PUBLISHED","baseScore":6.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","references":"https://github.com/nocobase/nocobase/security/advisories/GHSA-mvvv-v22x-xqwp\nhttps://github.com/nocobase/nocobase/pull/9079\nhttps://github.com/nocobase/nocobase/commit/2853368243ed07339c62c548b7d475f4eeaada59\nhttps://github.com/nocobase/nocobase/releases/tag/v2.0.37\n","enisa_id":"EUVD-2026-23613\n","assigner":"GitHub_M","epss":0.38,"dataProcessed":"Oct 27, 2026, 7:16:42 AM","vulnerabilityProduct":[{"id":"e48b0dc8-f704-3aea-8792-55abf9453946","product":{"name":"@nocobase/plugin-workflow-request","vendor":{"name":"nocobase"}},"product_version":"\u003c 2.0.37"}],"vulnerabilityVendor":[{"id":"0450effe-bf8a-334a-ae49-0e5a67965b96","vendor":{"name":"nocobase"}}]}}],"enisaIdAdvisory":[]}