Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-52887.
Unlock with Pro - from £29/user/moDetect NocoBase myInAppChannels:list SQL Injection to PostgreSQL Superuser RCE (CVE-2026-52887) in Microsoft Sentinel
CVE-2026-52887 is a critical (CVSS 10.0) SQL injection vulnerability in the @nocobase/plugin-notification-in-app-message plugin's /api/myInAppChannels:list endpoint filter parameter, affecting NocoBase versions <= 2.0.60. An unauthenticated or low-privileged attacker can inject arbitrary SQL through the filter query parameter, which is passed insufficiently sanitized into the underlying Sequelize/PostgreSQL query builder. Because NocoBase's database connection frequently runs with elevated (superuser) PostgreSQL privileges to support its dynamic schema/collection features, successful injection can be escalated via COPY ... TO/FROM PROGRAM or dblink/plpythonu extensions to achieve full remote code execution on the database host. Patched in v2.0.61 (PR #9630, commit 68d64e3).
MITRE ATT&CK
- Tactic
- Initial Access Execution
KQL Detection Query
let SuspiciousPatterns = dynamic(["COPY ", "PROGRAM", "dblink", "plpythonu", "UNION SELECT", "pg_read_file", "lo_import", "lo_export", "--", "/*", "information_schema"]);
AppServiceHTTPLogs
| where CsUriStem has "/api/myInAppChannels:list"
| where CsUriQuery has "filter"
| extend DecodedQuery = url_decode(CsUriQuery)
| where SuspiciousPatterns has_any (DecodedQuery)
| project TimeGenerated, CIp, CsMethod, CsUriStem, DecodedQuery, ScStatus
| union (
W3CIISLog
| where csUriStem has "/api/myInAppChannels:list"
| where csUriQuery has "filter"
| extend DecodedQuery = url_decode(csUriQuery)
| where SuspiciousPatterns has_any (DecodedQuery)
| project TimeGenerated, CIp=cIP, CsMethod=csMethod, CsUriStem=csUriStem, DecodedQuery, ScStatus=scStatus
)
| sort by TimeGenerated descDetects HTTP requests to the vulnerable NocoBase /api/myInAppChannels:list endpoint containing SQL injection payload indicators (COPY PROGRAM, dblink, UNION SELECT, comment sequences) in the filter query parameter, indicative of CVE-2026-52887 exploitation attempts.
Data Sources
Required Tables
False Positives & Tuning
- Security scanners/pentest tools legitimately testing the endpoint
- Developers debugging filter query construction with SQL-like strings
- Automated vulnerability scanning as part of authorized assessments
Other platforms for CVE-2026-52887
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate SQL Injection Probe Against myInAppChannels:list
Expected signal: HTTP access log entry showing GET /api/myInAppChannels:list with URL-encoded filter parameter containing 'UNION SELECT'.
- Test 2Simulate PostgreSQL COPY PROGRAM Injection Payload
Expected signal: HTTP log entry with decoded filter containing 'COPY' and 'PROGRAM'; if unpatched and role is superuser, PostgreSQL log shows the executed COPY PROGRAM statement and spawned OS process.
- Test 3Validate Patched Version Rejects Injection Payload
Expected signal: HTTP access log entry showing the same injection attempt, but application logs indicate a validation error (400 Bad Request) rather than a raw query execution.
References (6)
- https://github.com/nocobase/nocobase/security/advisories/GHSA-p849-8hwh-84j9
- https://nvd.nist.gov/vuln/detail/CVE-2026-52887
- https://github.com/nocobase/nocobase/pull/9630
- https://github.com/nocobase/nocobase/commit/68d64e3fcfb8be2ae4f3bfc9e1ee3f85b87c89ce
- https://github.com/nocobase/nocobase/releases/tag/v2.0.61
- https://github.com/advisories/GHSA-p849-8hwh-84j9
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-52887 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month