CVE-2026-79914 with a CVSS score of 4.3 is a server-side request forgery vulnerability in NocoBase v2.1.10, specifically the @nocobase/plugin-action-custom-request plugin, affecting @nocobase/plugin-action-custom-request (npm) versions >= 2.1.0-alpha.8, < 2.1.15 and >= 2.2.0-alpha.1, < 2.2.0-alpha.4. The flaw occurs in the customRequests:send action, where runtime request options are merged into stored request configuration, allowing the request URL to be replaced. A low-privileged authenticated user can call the customRequests:send endpoint and supply options.url, causing the NocoBase server to initiate outbound HTTP requests to attacker-controlled or internal destinations. The attack is network-based and requires only a valid low-privilege account; when SERVER_REQUEST_WHITELIST is not configured, the whitelist check does not prevent the request. Business impact includes internal service enumeration, access to services reachable only from the server-side network, Docker host gateway reachability, reading responses from internal HTTP services, potential access to cloud metadata endpoints, and use of the server as a trusted network proxy. This can expose internal-only services to low-privileged users and increase risk in cloud or production deployments where internal APIs, metadata services, or trusted network services are reachable.
We recommend you to update NocoBase @nocobase/plugin-action-custom-request to version 2.1.15, 2.2.0-alpha.4 depending on your installed branch.[/subscribe_to_unlock_form]
CVE-2026-79914 with a CVSS score of 4.3 is a server-side request forgery vulnerability in NocoBase v2.1.10, specifically the @nocobase/plugin-action-custom-request plugin, affecting @nocobase/plugin-action-custom-request (npm) versions >= 2.1.0-alpha.8, < 2.1.15 and >= 2.2.0-alpha.1, < 2.2.0-alpha.4. The flaw occurs in the customRequests:send action, where runtime request options are merged into stored request configuration, allowing the request URL to be replaced. A low-privileged authenticated user can call the customRequests:send endpoint and supply options.url, causing the NocoBase server to initiate outbound HTTP requests to attacker-controlled or internal destinations. The attack is network-based and requires only a valid low-privilege account; when SERVER_REQUEST_WHITELIST is not configured, the whitelist check does not prevent the request. Business impact includes internal service enumeration, access to services reachable only from the server-side network, Docker host gateway reachability, reading responses from internal HTTP services, potential access to cloud metadata endpoints, and use of the server as a trusted network proxy. This can expose internal-only services to low-privileged users and increase risk in cloud or production deployments where internal APIs, metadata services, or trusted network services are reachable.
We recommend you to update NocoBase @nocobase/plugin-action-custom-request to version 2.1.15, 2.2.0-alpha.4 depending on your installed branch.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]