CVE-2026-52888: Sensitive Data Exposure and Blacklist Bypass in NocoBase SQL Collection Plugin
Vulnerability ID: CVE-2026-52888
CVSS Score: 6.8
Published: 2026-07-28
NocoBase, an extensible low-code platform, was found to contain an information exposure vulnerability in its SQL Collection plugin. The validator designed to inspect SQL queries used an incomplete keyword-based blacklist, allowing users with administrative or collection creation privileges to bypass restrictions and execute arbitrary SELECT queries against PostgreSQL system catalogs. This flaw permits unauthenticated or privilege-escalated access to critical system files, active connection listings, and system user password hashes.
TL;DR
NocoBase versions prior to 2.1.0-alpha.46 used an incomplete blacklist in checkSQL() validator, enabling privileged users to read system databases, query schema metadata, and extract PostgreSQL MD5/SCRAM password hashes.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-184
- Attack Vector: Network (AV:N)
- CVSS Base Score: 6.8
- EPSS Score: 0.00269
- Exploit Maturity: Proof-of-Concept (PoC)
- CISA KEV Status: Not Listed
Affected Systems
- NocoBase low-code/no-code platform
- NocoBase SQL Collection Plugin (@nocobase/plugin-collection-sql)
-
@nocobase/plugin-collection-sql: <= 2.0.59 (Fixed in:
2.1.0-alpha.46)
Code Analysis
Commit: 87c5489
fix(plugin-collection-sql): security issues of sql collection
Commit: 4aecb60
refactor: add additional PostgreSQL blacklist views to dangerKeywords
Exploit Details
- GitHub Security Advisory: Official advisory outlining the SQL keyword-based bypass vulnerability and remediation parameters.
Mitigation Strategies
- Upgrade NocoBase installation to version 2.1.0-alpha.46, 2.0.62, or later.
- Enforce Least Privilege (least-privilege database user configurations) to prevent access to the system catalog.
- Revoke access rights on 'pg_shadow' and 'pg_authid' tables for the NocoBase connection user.
Remediation Steps:
- Identify all active NocoBase deployments utilizing PostgreSQL backends.
- Apply the patch using the official repository updates or upgrade the Docker container image to tag v2.0.62.
- Modify database privileges so that the database user account does not possess 'superuser' or 'rds_superuser' privileges.
- Audit active database tables for exposed application tokens and rotate database credentials.
References
Read the full report for CVE-2026-52888 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)