Vulnerabilities

Report: Latest: CVE-2026-40346 - NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins

2026-04-18 0 views admin

CVE ID :CVE-2026-40346 Published : April 18, 2026, 12:16 a.m. | 1 hour, 15 minutes ago Description :NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.37, NocoBase's workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An authenticated user can access internal network services, cloud metadata endpoints, and localhost. Version 2.0.37 contains a patch. Severity: 6.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE Details

CVE ID

CVE-2026-40346

Severity

LOW

Published

April 18, 2026

Attack Vector: network

Impact: SSRF

🏷️ Tags

reportlatest40346nocobaseworkflowrequestcustompluginscvecve-2026-40346

InfinitSec - Latest Cybersecurity, Technology & Gaming News

Report: Latest: CVE-2026-40346 - NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins

CVE Details

🏷️ Tags

More from Vulnerabilities

Report: CVE-2026-40337 - Sentry kernel has incomplete ownership check for IRQ line manipulation

Report: CVE-2026-40336 - libgphoto2 has memory leak in ptp_unpack_Sony_DPD() secondary enumeration list i

Report: CVE-2026-40335 - libgphoto2 has OOB read in ptp_unpack_DPV() UINT128/INT128 handling in ptp-pack.c - Guide

Report: CVE-2026-40333 - libgphoto2 has OOB read in ptp_unpack_EOS_ImageFormat() and ptp_unpack_EOS_Custo

Trending

CVE-2025-61481: Critical Remote Code Execution Vulnerability in MikroTik RouterOS & SwitchOS

CVE-2025-43939: Dell Unity OS Command Injection (High)

Google disputes false claims of massive Gmail data breach

Microsoft: DNS outage impacts Azure and Microsoft 365 services

3.5B Accounts, 1 Critical Flaw: Meta Closes WhatsApp Data-Harvesting