Critical NocoBase RCE Vulnerability Found

NocoBase is currently affected by a critical vulnerability, tracked as CVE-2026-52887, which carries a maximum CVSS score of 10. The flaw resides in the @nocobase/plugin-notification-in-app-message package, allowing an attacker to bypass security controls and execute arbitrary commands on the underlying host system.

What's at Risk

The vulnerability affects NocoBase server versions up to and including 2.0.57. Because the default configuration of the platform often enables sign-up capabilities for anonymous users, any internet-facing instance is at high risk. Attackers can create an account, authenticate, and then leverage the /api/myInAppChannels:list endpoint to trigger the injection.

Deployments using the default Docker container setup are particularly vulnerable. In these environments, the database role is typically granted superuser privileges. This configuration allows a successful exploit to extend beyond simple data exfiltration, granting the attacker the ability to run shell commands within the database container.

How the Flaw Works

This vulnerability is a form of SQL injection, a class of security weakness where an application fails to properly sanitize user-supplied input before including it in a database query. In general, when an application uses raw input to construct database commands, it creates a bridge between the user and the backend infrastructure. Attackers typically exploit this by injecting malicious SQL fragments that manipulate the query's logic.

In many environments, database drivers and configurations may permit multiple stacked queries. When an application interacts with a database using excessive privileges—such as superuser access—an attacker can move from manipulating application data to executing system-level commands. This often involves using built-in database features designed for file operations or program execution, effectively turning a database query into a gateway for full server compromise.

How to Protect Your Systems

• Update the @nocobase/plugin-notification-in-app-message package to version 2.0.61 or later immediately.
• Review and disable allowSignUp in the auth-basic configuration if public registration is not a business requirement.
• Audit your database container permissions to ensure the application connects using the principle of least privilege rather than superuser access.
• Restrict access to the NocoBase API to trusted IP addresses or internal networks until patches are fully deployed.
• Monitor server logs for suspicious activity targeting the /api/myInAppChannels:list endpoint.

Given the critical severity of this flaw and the ease with which it can be exploited by anonymous users, patching must be treated as a priority. The combination of SQL injection and container-level command execution creates a direct path to total system compromise, making prompt remediation the only effective defense for exposed NocoBase instances.