EUVD-2026-57413Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network reach (PR:N) but requires a pre-existing PUBLIC query over a credentialed REST datasource (AC:H); stolen upstream credentials affect another system (S:C) with confidentiality-only impact (C:H, I:N, A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration._req in packages/server/src/integrations/rest.ts attached credentials from getAuthHeaders and defaultHeaders without requiring the final request destination to match the datasource origin. An unauthenticated caller of a PUBLIC POST /api/v2/queries/:queryId query could supply an absolute or parameterized path to an attacker-controlled host and receive the stored bearer, basic, or static-header credentials. This issue is fixed in version 3.40.1.
AnalysisAI
Credential disclosure in the Budibase low-code platform (versions prior to 3.40.1) lets an unauthenticated attacker steal a REST datasource's stored Bearer, Basic, or static-header secrets. Because RestIntegration._req in packages/server/src/integrations/rest.ts attaches getAuthHeaders and defaultHeaders before resolving the request host, a PUBLIC-role query invoked via POST /api/v2/queries/:queryId can be pointed at an attacker-controlled host - using an absolute URL or a {{ parameter }} in the path - and the API-masked (--secret-value--) credentials are delivered in cleartext. Publicly available exploit code exists (full PoC in the GHSA advisory); no public evidence of active exploitation. This is a bypass of the earlier GHSA-3gp5 fix, which closed the base-URL rewrite vector but added no same-origin check.
Technical ContextAI
Budibase is an open-source low-code application platform whose REST datasource integration (packages/server/src/integrations/rest.ts) proxies outbound HTTP calls on behalf of user-defined queries. The root cause is a CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path handling) issue in getUrl(): when the parameter-enriched query path begins with 'http', the datasource base URL is discarded and the path becomes the absolute request URL. Critically, _req() builds authHeaders from the stored auth configs and merges config.defaultHeaders into the request BEFORE the destination host is resolved, and there is no comparison between the resolved request host and the datasource's configured origin. The execute route runs under authorized(QUERY, WRITE), but a query published at the PUBLIC role executes with no session, exposing the flaw to anonymous callers. The affected component is cpe:2.3:a:budibase:budibase (the @budibase/server npm package).
RemediationAI
Vendor-released patch: upgrade Budibase to 3.40.1 or later, which adds origin validation (the query path must remain on the datasource origin, returning HTTP 400 'REST query path must remain on the datasource origin') and a rejectCrossOriginRedirects option in fetchWithBlacklist to block cross-origin redirect-based leaks; see https://github.com/Budibase/budibase/pull/19239 and commit 8b1bca71501b11c68310351ef4f2c3028b2d5f08. If immediate upgrade is not possible, unpublish or restrict any query that is exposed at the PUBLIC role, particularly those backed by REST datasources that store Bearer/Basic tokens or static auth headers (trade-off: breaks any legitimately public REST-backed functionality); additionally rotate any credentials stored in REST datasources that may already have been exposed, and place the Budibase instance behind network controls limiting who can reach /api/v2/queries/:queryId. Advisory: https://github.com/Budibase/budibase/security/advisories/GHSA-mqhr-6j6h-74p5.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaS
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Unauthenticated account takeover of pending invited users in Budibase Server (@budibase/server) versions 3.41.0 through
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today