Critical NocoBase SQL Injection Chains to PostgreSQL Superuser RCE (CVE-2026-52887)

What Happened

A newly published GitHub Security Advisory (GHSA-p849-8hwh-84j9, CVE-2026-52887, CVSS 10.0) discloses a critical SQL injection in NocoBase's bundled @nocobase/plugin-notification-in-app-message plugin, affecting versions <=2.0.57. According to the advisory, the GET /api/myInAppChannels:list endpoint builds a Sequelize literal() query by splicing the filter[latestMsgReceiveTimestamp][$lt] parameter directly into a SQL template string with no escaping or parameter binding.

The advisory reports this endpoint is only gated by a loggedIn ACL check, and that the default auth-basic authenticator ships with allowSignUp: true — meaning an attacker can self-register an account and immediately reach the vulnerable endpoint. The report further states that the shipped Docker Compose configuration provisions the PostgreSQL role as a database superuser (via a stock postgres:16 image), and that the pg driver's simple-query protocol permits stacked statements, allowing the injection to escalate from boolean/time-based blind SQLi to arbitrary command execution via COPY ... TO PROGRAM, running as uid=999(postgres) inside the database container. The advisory includes a working PoC (sqlmap-confirmed) and states exfiltration of the admin password hash was demonstrated in testing on 2026-05-26.

Why It Matters

This is reported as a full unauthenticated-to-RCE chain in a default deployment: no admin action or prior credentials are required beyond self-service sign-up, which is enabled out of the box. Any organization running the official NocoBase Docker images with the notification-in-app-message plugin enabled (the advisory notes it ships by default in @nocobase/preset-nocobase) should treat this as pre-authentication in practical terms. Successful exploitation, per the advisory, yields both database-wide data exfiltration and container-level shell access — a severe blast radius for a low-complexity injection.

What Defenders Should Do Now

• Check whether NocoBase is deployed, whether it uses the default Docker Compose setup, and whether plugin-notification-in-app-message is enabled.
• Review whether auth-basic has allowSignUp disabled or restricted — self-registration is the initial foothold described in the advisory.
• Audit the PostgreSQL role backing NocoBase for superuser privileges; the advisory notes this is a root cause enabler for the RCE step, independent of the injection itself.
• Hunt for anomalous requests to /api/myInAppChannels:list containing SQL-like tokens (AND, SELECT, PG_SLEEP, COPY, TO PROGRAM) in the filter query parameter, and for unexpected new user sign-ups via /api/auth:signUp.
• Monitor PostgreSQL logs for COPY ... TO PROGRAM statements or unexpected child processes spawned by the postgres user inside the database container.
• Until an upstream fix is applied and confirmed, consider restricting external access to the affected endpoint or plugin.

Developing Intel

This is a same-day advisory and details here are drawn directly from the published GHSA; no independent verification has been performed by df00tech. This entry will be revisited as patch guidance and vendor response develop. Full technical detail, reproduction steps, and credit: GHSA-p849-8hwh-84j9.