Description
NocoBase’s workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An authenticated user can access internal network services, cloud metadata endpoints, and localhost.
Recommendation
Update the @nocobase/plugin-workflow-request package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.0.37
- Patched version(s): 2.0.37
References
Could your website be exposed too?
SmartScanner can check your website for NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access - CVE-2026-31829
- Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox - CVE-2026-41270
- Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - CVE-2026-42264
- Payload has Authenticated SSRF via Upload Functionality - CVE-2026-34746
You might also like:
See something that needs correcting? Let us knowUpdated May 14, 2026