CVE-2026-52888: NocoBase SQL Injection Vulnerability

CVE-2026-52888 Overview

CVE-2026-52888 affects NocoBase, an AI-powered no-code/low-code platform for building business applications. The vulnerability resides in the @nocobase/plugin-collection-sql package, where the checkSQL() function in packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts implements an incomplete keyword blacklist [CWE-184]. The blacklist fails to restrict access to PostgreSQL system catalog tables including pg_shadow, pg_roles, and pg_stat_activity. An admin-role user can exploit this gap through the SQL Collection feature to read password hashes and database metadata. NocoBase versions 2.0.59 and earlier are affected, with a fix delivered in 2.1.0-alpha.46.

Critical Impact
Authenticated admin users can extract PostgreSQL password hashes and sensitive database metadata, enabling lateral movement and credential compromise.

Affected Products

NocoBase versions 2.0.59 and earlier
@nocobase/plugin-collection-sql plugin
NocoBase deployments backed by PostgreSQL databases

Discovery Timeline

2026-07-15 - CVE-2026-52888 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-52888

Vulnerability Analysis

The vulnerability is an information disclosure flaw stemming from an incomplete denylist in the SQL Collection feature. NocoBase allows admin users to define virtual collections backed by raw SQL queries. To limit abuse, the plugin validates queries via checkSQL(), which rejects specific dangerous functions and keywords. The pre-patch denylist covered functions like pg_reload_conf, pg_sleep, and generate_series but omitted PostgreSQL system catalog identifiers. This omission allowed queries that read directly from pg_shadow, pg_authid, pg_roles, and pg_stat_activity, exposing hashed authentication material and session data.

Root Cause

The root cause is reliance on an incomplete blacklist for input validation [CWE-184]. Blacklist-based filtering is inherently fragile because it depends on enumerating all dangerous constructs. The checkSQL() implementation did not account for PostgreSQL metadata tables and the information_schema namespace, which expose credentials and structural details to any query that can reach them.

Attack Vector

An attacker who has already obtained admin-level credentials in NocoBase authors a SQL Collection referencing PostgreSQL system tables. Because checkSQL() accepts the query, the server executes it with the database role NocoBase uses, returning password hashes from pg_shadow or role membership from pg_roles. Extracted hashes can be cracked offline to compromise database or reused credentials across systems.

typescript

     'pg_reload_conf',
     'pg_sleep',
     'generate_series',
+    'pg_catalog',
+    'pg_shadow',
+    'pg_authid',
+    'pg_auth_members',
+    'pg_roles',
+    'pg_stat_activity',
+    'information_schema',
 
     // MySQL
     'LOAD_FILE',

Source: GitHub Commit 87c5489. The patch extends the checkSQL() denylist to block queries referencing PostgreSQL system catalogs and the information_schema namespace.

Detection Methods for CVE-2026-52888

Indicators of Compromise

SQL Collection definitions containing references to pg_shadow, pg_authid, pg_roles, pg_stat_activity, pg_catalog, or information_schema
PostgreSQL query logs showing NocoBase's database user selecting from system catalog tables outside normal application patterns
Unexpected admin account creation or configuration changes in NocoBase preceding metadata queries

Detection Strategies

Enable PostgreSQL log_statement = 'all' or targeted logging for queries against pg_catalog.* tables and correlate with NocoBase application activity
Audit stored SQL Collection definitions in the NocoBase configuration database for blacklisted keywords
Review NocoBase application logs for admin actions creating or modifying SQL Collections

Monitoring Recommendations

Monitor PostgreSQL role activity for reads against pg_shadow and pg_authid by non-superuser application accounts
Alert on any NocoBase admin session that creates SQL Collections referencing system schemas
Track anomalous authentication failures against the PostgreSQL instance that may indicate offline hash cracking follow-up

How to Mitigate CVE-2026-52888

Immediate Actions Required

Upgrade NocoBase to version 2.1.0-alpha.46 or later, which extends the checkSQL() denylist
Rotate all PostgreSQL role passwords, especially any that may have been exposed through pg_shadow or pg_authid
Review the admin user roster in NocoBase and remove unnecessary admin-level privileges

Patch Information

The fix is available in NocoBase 2.1.0-alpha.46. See the GitHub Release v2.1.0-alpha.46, the GitHub Security Advisory GHSA-v8vm-cqh8-q87q, and the remediation commit for details.

Workarounds

Restrict the NocoBase database role to a dedicated schema and revoke SELECT on pg_catalog system tables where feasible
Disable the @nocobase/plugin-collection-sql plugin if SQL Collections are not required in your deployment
Configure the NocoBase PostgreSQL user as a non-superuser with least-privilege access to only application schemas

bash

# Revoke access to PostgreSQL system catalogs for the NocoBase application role
REVOKE SELECT ON pg_catalog.pg_shadow FROM nocobase_app;
REVOKE SELECT ON pg_catalog.pg_authid FROM nocobase_app;
REVOKE SELECT ON pg_catalog.pg_roles FROM nocobase_app;
REVOKE SELECT ON pg_catalog.pg_stat_activity FROM nocobase_app;