CVE-2026-52887: Critical SQL Injection in NocoBase's In-App Notification Plugin Enables Superuser RCE

Overview

CVE-2026-52887 is a critical (CVSS 10.0) SQL injection vulnerability (CWE-89) in the @nocobase/plugin-notification-in-app-message plugin, specifically in the filter query parameter of the /api/myInAppChannels:list endpoint. The parameter is passed into NocoBase's Sequelize/PostgreSQL query builder without sufficient sanitization, allowing arbitrary SQL to be injected into the resulting query.

The impact is severe because NocoBase's database connection frequently runs with elevated PostgreSQL superuser privileges to support its dynamic schema and collection features. An attacker who successfully injects SQL can escalate from data access to full remote code execution on the database host using techniques such as COPY ... TO/FROM PROGRAM or the dblink/plpythonu extensions.

Affected Software

• Vendor/Ecosystem: npm
• Product: @nocobase/plugin-notification-in-app-message
• Affected versions: <= 2.0.60
• Patched in: v2.0.61 (PR #9630, commit 68d64e3)

Exploitation requires only unauthenticated or low-privileged access to the endpoint, significantly widening the pool of potential attackers.

Exploitation Status

A public proof-of-concept exists for this vulnerability. There is currently no indication it has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog or observed as weaponized in the wild, but given the CVSS 10.0 severity, unauthenticated reachability, and public PoC availability, defenders should treat mass scanning and opportunistic exploitation as a near-term likelihood and prioritize patching or compensating controls immediately.

How Our Detection Works

We ship coverage for this vulnerability across Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL).

At a high level, the detection logic focuses on identifying anomalous requests to the myInAppChannels:list endpoint where the filter parameter contains SQL metacharacters, injection payload patterns (e.g., UNION-based, boolean-blind, or PostgreSQL-specific syntax such as COPY, dblink, or plpythonu references), or unexpected query structure indicative of injection attempts. Correlation logic also looks for post-exploitation signals — such as database processes spawning unexpected child processes or outbound connections following suspicious requests to this endpoint — to help distinguish successful RCE attempts from mere scanning noise.

Get the Full Detection

For the complete KQL, SPL, and other SIEM queries, MITRE ATT&CK mapping, and remediation guidance for CVE-2026-52887, see the full detection page: https://df00tech.com/detections/CVE-2026-52887.