CVE-2026-79914

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Versions 2.1.0 through 2.1.14 contain a server-side request forgery vulnerability in the customRequests:send endpoint. A low-privileged authenticated user can override the stored request URL at runtime using options.url, causing the NocoBase server to send requests to attacker-controlled or internal destinations. Exploitation could expose internal services, Docker host gateways, or cloud metadata endpoints and allow the server to be used as a trusted network proxy. This issue has been fixed in version 2.1.15.

• CWE-918

• https://github.com/nocobase/nocobase/commit/037dade8592fbab4324107285463f92b45aaa2ff
• https://github.com/nocobase/nocobase/security/advisories/GHSA-wrr5-j383-f7h2
• https://github.com/nocobase/nocobase/security/advisories/GHSA-wrr5-j383-f7h2

Published

Nov 10, 2026

Last Modified

Nov 14, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-79909Acrobat Reader is affected by a Use After Free vulnerability…7.8
• CVE-2026-7991Use after free in UI in Google Chrome prior to 148.0.7778.96…8.8
• CVE-2026-79910Acrobat Reader is affected by an out-of-bounds read vulnerab…5.5
• CVE-2026-79911A security vulnerability has been detected in TOTOLINK N600R…10
• CVE-2026-79912A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_…8.3
• CVE-2026-79913Cloudreve is a self-hosted file management and sharing syste…6.5
• CVE-2026-79916MaxKB is an open-source AI assistant for enterprise. Prior t…9.1
• CVE-2026-79917MaxKB is an open-source AI assistant for enterprise. In 2.7.…6.5
• CVE-2026-79918MaxKB is an open-source AI assistant for enterprise. Prior t…6.3
• CVE-2026-79919MaxKB is an open-source AI assistant for enterprise. Prior t…6.3
• CVE-2026-7992Insufficient validation of untrusted input in UI in Google C…8.8
• CVE-2026-79920Ajenti is a Linux & BSD modular server admin panel. Prior to…9.9