CVE-2026-52888 NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass
An admin user can bypass SQL restrictions to read sensitive database metadata and password hashes in NocoBase.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-52888?
CVE-2026-52888 is a medium-severity vulnerability in nocobase, published on 15 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.59 and earlier, NocoBase @nocobase/plugin-collection-sql used the checkSQL() function in packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts with an incomplete keyword blacklist that did not restrict PostgreSQL system catalog tables such as pg_shadow, pg_roles, and pg_stat_activity, allowing an admin-role user to read password hashes and database metadata through the SQL Collection feature. This vulnerability is fixed in 2.1.0-alpha.46.
Which versions are affected by CVE-2026-52888?
6 open source packages ship an affected version, including @nocobase/plugin-collection-sql.
| Package | Affected | Fixed in |
|---|---|---|
@nocobase/plugin-collection-sql npm | All versions | 2.0.62 |
@nocobase/plugin-collection-sql npm | All versions | 2.0.62 |
@nocobase/plugin-collection-sql npm | From 2.1.0-alpha.1 | 2.1.0-alpha.46 |
@nocobase/plugin-collection-sql npm | From 2.1.0-alpha.1 | 2.1.0-alpha.46 |
@nocobase/plugin-collection-sql npm | From 2.1.0-beta.1 | 2.1.0-beta.45 |
@nocobase/plugin-collection-sql npm | From 2.1.0-beta.1 | 2.1.0-beta.45 |
How do I fix CVE-2026-52888?
Upgrade @nocobase/plugin-collection-sql to a fixed version for your release line: 2.0.62, 2.1.0-alpha.46 or 2.1.0-beta.45.
Is CVE-2026-52888 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-52888 exists.
Sources
Also known as GHSA-v8vm-cqh8-q87q.