Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-40346

22
FAUCET Score

NocoBase versions prior to 2.0.37 contain a Server-Side Request Forgery (SSRF) vulnerability in the workflow HTTP request plugin and custom request action plugin that fails to validate user-supplied URLs before making server-side HTTP requests. An authenticated attacker can exploit this flaw to access internal network services, cloud metadata endpoints, and localhost services that should not be accessible from the internet. The vulnerability requires user authentication but presents a moderate risk due to its potential to expose sensitive internal infrastructure and cloud credentials. The EPSS score of 0.00014 indicates very low real-world exploitability probability, and the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog, suggesting no active exploitation in the wild. Organizations running NocoBase should upgrade to version 2.0.37 or later to remediate this issue.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.0.37CPE matchmatch criteria
cpe:2.3:a:nocobase:nocobase:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 4.0

6.4MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
VS Confidentiality
NONE
VS Integrity
NONE
VS Availability
NONE
SS Confidentiality
HIGH
SS Integrity
HIGH
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.38%
Probability of exploitation in next 30 days
EPSS Percentile
31.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0038 is in the 40th percentile among its peer group of 21,954 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

github_advisorypatch availablevia nvd_reference
View patch
npmpatch availablevia ghsa
Product: @nocobase/plugin-workflow-requestFixed in: 2.0.37

Vendor Advisories (1)

npmGHSA-mvvv-v22x-xqwpmedium

NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins

Apr 15, 2026

References

github.com / nocobase/nocobase/commit/2853368243ed07339c62c548b7d475f4eeaada59
Patch
github.com / nocobase/nocobase/pull/9079
ExploitPatch
github.com / nocobase/nocobase/releases/tag/v2.0.37
Release Notes
github.com / nocobase/nocobase/security/advisories/GHSA-mvvv-v22x-xqwp
ExploitVendor Advisory