EUVD-2026-51822
GHSA-9v65-w6j3-v2w8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Builder role required to configure REST datasources (PR:H); scope changes as cloud metadata services on subsequent systems are accessed (S:C/C:H); no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to internal IP addresses, bypassing blacklist protection to access cloud metadata endpoints and internal services.
AnalysisAI
Server-side request forgery in Budibase's REST datasource integration exposes internal cloud infrastructure to authenticated Builder-role users in all versions prior to 3.38.1. The flaw allows a Builder to configure a REST datasource pointing to an attacker-controlled external server, which then responds with an HTTP redirect to a blocked internal IP - the redirect target is never re-validated against the platform's IP blacklist, granting access to cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254) and other internal services. No public exploit code or active exploitation has been identified at time of analysis, but the technique is well-documented in SSRF research and requires only a Builder account, which is routinely granted in collaborative low-code environments.
Technical ContextAI
Budibase is an open-source low-code platform that allows users to build internal tools by connecting to REST APIs and other datasources. The REST datasource integration makes outbound HTTP requests on behalf of the server, and Budibase implements an IP blacklist intended to prevent access to private address ranges (RFC 1918 and link-local such as 169.254.0.0/16). The root cause, classified as CWE-918 (Server-Side Request Forgery), is that the blacklist check is only applied to the initial URL - when the upstream server returns an HTTP 3xx redirect, Budibase follows it transparently without re-evaluating the redirect destination against the same blacklist. This is a well-known SSRF bypass pattern. Affected CPE is cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:* covering all versions below 3.38.1.
RemediationAI
Upgrade Budibase to version 3.38.1 or later, which introduces redirect validation against the IP blacklist. The vendor security advisory is published at https://github.com/Budibase/budibase/security/advisories/GHSA-86f3-cqpq-wp9m and should be reviewed for additional mitigating guidance. For operators unable to patch immediately, the most actionable compensating control is to restrict the Builder role to fully trusted internal users only, reducing the pool of accounts that can configure REST datasources. Additionally, if the deployment runs in a cloud environment, enable IMDSv2 (session-oriented metadata service) on all underlying instances - IMDSv2 requires a PUT-based session token that Budibase's REST datasource integration cannot trivially forge, substantially reducing the value of metadata endpoint access. Blocking outbound HTTP from the Budibase application server to RFC 1918 and link-local address ranges at the network/firewall layer provides defense-in-depth independent of application-level blacklists, though this may interfere with legitimate REST datasource connections to internal APIs. Neither network control is a substitute for patching.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaS
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Unauthenticated account takeover of pending invited users in Budibase Server (@budibase/server) versions 3.41.0 through
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today