Product

nocobase @nocobase/plugin-workflow-request vulnerabilities

1 published CVE affecting nocobase @nocobase/plugin-workflow-request, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total: 1
Critical: 0
High: 0
Medium: 1
Low: 0
Unscored: 0
CISA KEV: 0

Latest nocobase @nocobase/plugin-workflow-request CVEs

Newest publication first

CVE-2026-40346 NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins
Published 2026-04-17

MediumCVSS 6.4 EPSS 0.38%

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.37, NocoBase's workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.

nocobase @nocobase/plugin-workflow-request vulnerabilities

Latest nocobase @nocobase/plugin-workflow-request CVEs

CVE-2026-40346 NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins