CVE-2026-88403 Details
Description
A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request.
A Server-Side Request Forgery (SSRF) vulnerability has been identified in NocoBase version 2.1.21. The issue arises in the 'serverRequest' function of the '@nocobase/utils' package, where the default configuration allows authenticated attackers to send crafted HTTP requests that access internal resources. This vulnerability exists because the 'SERVER_REQUEST_WHITELIST' environment variable is not set by default, leaving internal IP addresses unprotected.
It is recommended to configure the 'SERVER_REQUEST_WHITELIST' environment variable to block requests to internal IP addresses by default. The whitelist should be used to allow specific hosts while denying requests to private IPs when the whitelist is not configured.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/czx1111/cve/issues/7 | CISA-ADP | ExploitIssue TrackingTechnical Description |
| https://github.com/czx1111/cve/issues/7 | [email protected] | ExploitIssue TrackingTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| NocoBase | 2.1.21 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |