EUVD-2026-57413Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network reach (PR:N) but requires a pre-existing PUBLIC query over a credentialed REST datasource (AC:H); stolen upstream credentials affect another system (S:C) with confidentiality-only impact (C:H, I:N, A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration._req in packages/server/src/integrations/rest.ts attached credentials from getAuthHeaders and defaultHeaders without requiring the final request destination to match the datasource origin. An unauthenticated caller of a PUBLIC POST /api/v2/queries/:queryId query could supply an absolute or parameterized path to an attacker-controlled host and receive the stored bearer, basic, or static-header credentials. This issue is fixed in version 3.40.1.
AnalysisAI
Credential disclosure in the Budibase low-code platform (versions prior to 3.40.1) lets an unauthenticated attacker steal a REST datasource's stored Bearer, Basic, or static-header secrets. Because RestIntegration._req in packages/server/src/integrations/rest.ts attaches getAuthHeaders and defaultHeaders before resolving the request host, a PUBLIC-role query invoked via POST /api/v2/queries/:queryId can be pointed at an attacker-controlled host - using an absolute URL or a {{ parameter }} in the path - and the API-masked (--secret-value--) credentials are delivered in cleartext. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) a REST datasource configured with stored credentials - a Bearer token, Basic auth, or static defaultHeaders - and (2) a query using that datasource that has been published with the PUBLIC role, making POST /api/v2/queries/:queryId reachable without any session; the attacker then supplies a request path that is either an absolute URL beginning with 'http' or a user-controlled {{ parameter }} resolving to an attacker-chosen host, so that getUrl() discards the datasource base URL. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 score of 9.0 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N) reflects a network-reachable, unauthenticated attack whose only real gate is the AT:P attack requirement - a REST datasource with stored credentials must already exist AND a query using it must be published with the PUBLIC role. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker discovers an internet-facing Budibase app whose REST datasource holds a Bearer token for an internal API, and where a query using that datasource is published with the PUBLIC role. With a single unauthenticated HTTP POST to /api/v2/queries/:queryId, they supply an absolute URL (or a {{ parameter }} path) pointing at their own server, and Budibase dutifully forwards the stored credentials to the attacker's host. … |
| Remediation | Vendor-released patch: upgrade Budibase to 3.40.1 or later, which adds origin validation (the query path must remain on the datasource origin, returning HTTP 400 'REST query path must remain on the datasource origin') and a rejectCrossOriginRedirects option in fetchWithBlacklist to block cross-origin redirect-based leaks; see https://github.com/Budibase/budibase/pull/19239 and commit 8b1bca71501b11c68310351ef4f2c3028b2d5f08. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Budibase instances running versions before 3.40.1 and audit which REST datasources contain production credentials or access sensitive systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an
Authentication bypass in Budibase low-code platform (versions prior to 3.35.4) allows remote unauthenticated attackers t
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today