CVE-2026-88403 Overview
CVE-2026-88403 is a Server-Side Request Forgery (SSRF) vulnerability in NocoBase version 2.1.21. The flaw resides in the serverRequest function and allows authenticated attackers to issue crafted HTTP requests through the application backend. Successful exploitation lets an attacker scan internal network resources that are otherwise unreachable from the public internet. The issue is classified as [CWE-918]: Server-Side Request Forgery.
Critical Impact
Authenticated attackers can leverage the NocoBase backend as a proxy to enumerate internal services, cloud metadata endpoints, and other resources behind the application's network perimeter.
Affected Products
- NocoBase v2.1.21
Discovery Timeline
- 2026-09-21 - CVE-2026-88403 published to the National Vulnerability Database (NVD)
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-88403
Vulnerability Analysis
NocoBase exposes a serverRequest function used by the application to perform outbound HTTP requests on behalf of authenticated users. The function accepts request parameters, including destination URLs, without sufficient validation of the target host. An authenticated attacker can submit a crafted request that instructs the server to connect to arbitrary internal endpoints. The server executes the request from its own network position and returns response data or timing information to the caller.
This behavior enables internal reconnaissance from a trusted network vantage point. Attackers can probe private IP ranges, loopback addresses, and cloud provider metadata services. Additional technical context is available in the GitHub CVE Issue Discussion.
Root Cause
The root cause is missing or insufficient allowlist validation of user-supplied URLs passed to the serverRequest function. The function trusts caller-controlled destinations and does not restrict requests to a defined set of external hosts or block requests to internal address space.
Attack Vector
Exploitation requires network access to the NocoBase application and valid authentication credentials. No user interaction is required. The attacker submits an HTTP request containing a URL that targets internal infrastructure. The server-side handler forwards the request and returns response content, headers, or observable timing to the attacker. The current EPSS probability is 0.396%.
No verified public exploit code is available. The vulnerability is described in prose only; see the referenced advisory for additional technical detail.
Detection Methods for CVE-2026-88403
Indicators of Compromise
- Outbound HTTP requests from the NocoBase application server directed at RFC1918 addresses, loopback (127.0.0.1), or link-local addresses such as 169.254.169.254.
- Application logs showing invocations of serverRequest with unusual, non-business-related URL parameters.
- Bursts of sequential connection attempts from the NocoBase server to internal ports characteristic of port scanning.
Detection Strategies
- Instrument the serverRequest handler to log the caller identity, destination URL, and response status for every invocation.
- Correlate authenticated NocoBase user sessions with outbound network flows originating from the application host.
- Alert on any outbound request from NocoBase to cloud metadata endpoints or private IP ranges that fall outside expected integrations.
Monitoring Recommendations
- Forward NocoBase application and network logs to a centralized analytics platform for retention and query.
- Baseline normal outbound destinations for the NocoBase server and flag deviations.
- Monitor authenticated user accounts for anomalous request volume or access patterns against the serverRequest endpoint.
How to Mitigate CVE-2026-88403
Immediate Actions Required
- Upgrade NocoBase to a version later than 2.1.21 once a fixed release is available from the vendor.
- Restrict access to the NocoBase application to trusted users and enforce strong authentication.
- Place the NocoBase server in a network segment that cannot reach sensitive internal services or cloud metadata endpoints.
Patch Information
No vendor patch reference is listed in the NVD entry at the time of publication. Track the GitHub CVE Issue Discussion for remediation updates and monitor the NocoBase project releases for a fixed version.
Workarounds
- Deploy an egress proxy or firewall rule that blocks NocoBase server traffic to internal address ranges and metadata IPs such as 169.254.169.254.
- Enforce a URL allowlist at a reverse proxy in front of any outbound integration the application requires.
- Rotate credentials and audit accounts if unauthorized use of the serverRequest function is suspected.
# Example egress restriction using iptables to block metadata and private ranges
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
