EUVD-2026-51822
GHSA-9v65-w6j3-v2w8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Builder role required to configure REST datasources (PR:H); scope changes as cloud metadata services on subsequent systems are accessed (S:C/C:H); no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to internal IP addresses, bypassing blacklist protection to access cloud metadata endpoints and internal services.
AnalysisAI
Server-side request forgery in Budibase's REST datasource integration exposes internal cloud infrastructure to authenticated Builder-role users in all versions prior to 3.38.1. The flaw allows a Builder to configure a REST datasource pointing to an attacker-controlled external server, which then responds with an HTTP redirect to a blocked internal IP - the redirect target is never re-validated against the platform's IP blacklist, granting access to cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254) and other internal services. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker holds the Budibase Builder role, which is the direct prerequisite confirmed both by the CVE description and the CVSS PR:H metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.2 with vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N correctly captures the dual-system confidentiality impact: the vulnerable Budibase server itself can expose its own credentials/configuration (VC:H), and subsequent systems - particularly cloud metadata services - are also reachable (SC:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with an existing Budibase Builder account - obtained via legitimate access, phishing, or credential compromise - creates a new REST datasource configured to contact an attacker-controlled external server. When Budibase queries the datasource, the external server responds with a 301 redirect to http://169.254.169.254/latest/meta-data/ (AWS IMDSv1). … |
| Remediation | Upgrade Budibase to version 3.38.1 or later, which introduces redirect validation against the IP blacklist. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Budibase deployments, document current versions, and identify systems running versions prior to 3.38.1; simultaneously, audit Builder role assignments to understand exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an
Authentication bypass in Budibase low-code platform (versions prior to 3.35.4) allows remote unauthenticated attackers t
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today