CVE-2026-112306: NocoBase Plugin SQL Injection Vulnerability

CVE-2026-112306 Overview

CVE-2026-112306 is a SQL injection vulnerability in the NocoBase @nocobase/plugin-collection-sql plugin through version 2.2.28. The flaw allows privileged users holding the collection-sql snippet to store unvalidated SQL statements by bypassing the checkSQL() validation routine through the sqlCollection:setFields action. Attackers can replace a benign collection query with dangerous statements that execute on reload. Successful exploitation enables reading of PostgreSQL pg_shadow password hashes or invoking pg_read_file to access arbitrary files on the database host. The vulnerability is classified as [CWE-89] SQL Injection.

Critical Impact

Authenticated attackers can exfiltrate PostgreSQL credential hashes and read arbitrary files from the database server through stored SQL injection in NocoBase collection definitions.

Affected Products

• NocoBase @nocobase/plugin-collection-sql versions through 2.2.28
• NocoBase deployments using the SQL collection plugin
• Deployments backed by PostgreSQL with pg_shadow or pg_read_file accessible

Discovery Timeline

• 2026-10-19 - CVE-2026-112306 published to NVD
• 2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-112306

Vulnerability Analysis

The NocoBase SQL collection plugin exposes a sqlCollection:setFields resource action that writes SQL into a collection definition. The server-side handler fails to re-apply the checkSQL() validation routine used by other code paths. This gap allows a privileged user with the collection-sql snippet to replace a previously benign query with arbitrary SQL. The stored statement is persisted as the collection's underlying query.

When the collection is reloaded, the server executes the stored SQL against the backing database. On PostgreSQL deployments, attackers can issue statements that read the pg_shadow system catalog, which contains password hashes for database roles. Attackers can also invoke pg_read_file to retrieve the contents of files readable by the PostgreSQL process. The vulnerability converts a privileged application role into effective read access against the database host filesystem and credential store.

Root Cause

The root cause is inconsistent input validation across resource actions in @nocobase/plugin-collection-sql. The checkSQL() function enforces restrictions on which SQL constructs are permitted when a collection is created or updated through the primary path. The sqlCollection:setFields action modifies collection fields and the underlying SQL without routing input through checkSQL(). The validation gap is visible in the plugin source at packages/plugins/@nocobase/plugin-collection-sql/src/server/resources/sql.ts as referenced in the VulnCheck SQL Injection Advisory.

Attack Vector

An attacker authenticates to NocoBase with an account that holds the collection-sql snippet. The attacker invokes the sqlCollection:setFields action against an existing SQL collection and submits a payload containing attacker-controlled SQL. The stored SQL executes the next time the collection is reloaded. The attacker then reads results through the collection's standard data retrieval interface, extracting pg_shadow hashes or file contents returned by pg_read_file. Review the vulnerable handler in the GitHub SQL Plugin Code.

Detection Methods for CVE-2026-112306

Indicators of Compromise

• Unexpected modifications to SQL collection definitions by non-administrative accounts holding the collection-sql snippet.
• PostgreSQL query logs showing reads against pg_shadow or calls to pg_read_file originating from the NocoBase application role.
• HTTP requests to the sqlCollection:setFields endpoint containing SQL keywords beyond simple SELECT constructs.
• Reload events on SQL collections immediately following field update requests from the same session.

Detection Strategies

• Inspect application access logs for POST requests to sqlCollection:setFields and correlate with the authenticated user's role assignments.
• Enable PostgreSQL log_statement = 'all' or equivalent and alert on queries referencing pg_shadow, pg_authid, or pg_read_file from the NocoBase database user.
• Review NocoBase audit records for changes to SQL collection definitions outside approved change windows.

Monitoring Recommendations

• Forward NocoBase application logs and PostgreSQL audit logs to a central SIEM for correlation across the application and database tiers.
• Alert on any invocation of pg_read_file, pg_ls_dir, or reads against system catalogs by application service accounts.
• Track role and snippet assignments; alert when the collection-sql snippet is granted to a new principal.

How to Mitigate CVE-2026-112306

Immediate Actions Required

• Audit all accounts assigned the collection-sql snippet and revoke it from any principal that does not require SQL collection authoring.
• Review existing SQL collection definitions for unexpected statements referencing system catalogs or filesystem functions.
• Restrict the PostgreSQL role used by NocoBase so it cannot read pg_shadow or execute pg_read_file.
• Rotate PostgreSQL credentials if logs show prior exposure of pg_shadow contents.

Patch Information

NocoBase has not published a fixed version identifier in the referenced advisory at the time of CVE publication. Monitor the GitHub Nocobase Repository and tracking entry GitHub Issue #10629 for a release that routes sqlCollection:setFields input through checkSQL(). Upgrade beyond version 2.2.28 once a patched release is announced.

Workarounds

• Remove the collection-sql snippet from all non-administrative roles until a patched release is deployed.
• Deploy NocoBase against a least-privilege PostgreSQL role that lacks superuser rights and cannot read pg_shadow or invoke filesystem functions.
• Place NocoBase administrative endpoints behind network-level access controls so only trusted operators can reach sqlCollection:setFields.
• Disable or uninstall the @nocobase/plugin-collection-sql plugin if SQL collections are not required in the deployment.