EUVD-2026-57430
GHSA-hfhx-w8p8-4hc7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Builder-level auth required (PR:L); scope changes as server reaches subsequent internal systems (S:C); high confidentiality loss via cloud metadata exposure (C:H); no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.39.4, uploadUrl in packages/server/src/utilities/fileUtils.ts used a bare server-side fetch for string attachment values passed by processAttachments in packages/server/src/sdk/workspace/ai/helpers/rows.ts. A builder with the AI table-generation feature could cause an attachment value to reference an internal service or cloud metadata endpoint, and the response would be stored as an attachment without fetchWithBlacklist validation. This issue is fixed in version 3.39.4.
AnalysisAI
Server-Side Request Forgery in Budibase's AI table generation pipeline (versions prior to 3.39.4) allows a builder-level user to coerce the server into fetching arbitrary internal network endpoints - including cloud metadata services such as 169.254.169.254 - by crafting LLM prompts that cause the AI to output internal IP addresses as attachment column values. The vulnerable code path, uploadUrl() in fileUtils.ts, uses a bare node-fetch call with no SSRF blacklist validation, while sibling code paths in the same codebase correctly use fetchWithBlacklist(). No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; a vendor-released patch is available in version 3.39.4.
Technical ContextAI
Budibase is an open-source, Node.js-based low-code platform distributed via npm as @budibase/server. The root cause is CWE-918 (Server-Side Request Forgery): an inconsistent application of the project's own SSRF mitigation. The vulnerable function uploadUrl() in packages/server/src/utilities/fileUtils.ts issued a raw fetch(url) call (via node-fetch) without consulting fetchWithBlacklist(), which validates URLs against private/internal IP ranges before making requests. This function is invoked from processAttachments() in packages/server/src/sdk/workspace/ai/helpers/rows.ts whenever the AI table generation feature (generateRows()) produces string-typed attachment column values from LLM output. The CVSS 4.0 AT:P metric correctly reflects that the AI/LLM integration feature must be configured and accessible for exploitation. The CPE cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:* covers all affected versions, with the exact vulnerable range confirmed as < 3.39.4.
RemediationAI
The primary fix is upgrading Budibase to version 3.39.4 or later, available at https://github.com/Budibase/budibase/releases/tag/3.39.4. The patch (PR #18866, commit fc8161e) replaces the bare fetch(url) call in uploadUrl() with utils.fetchWithBlacklist(url) from @budibase/backend-core, which validates all URLs - including redirect destinations - against internal/private IP ranges before making the request; no functionality is lost for legitimate external attachment URLs. If immediate upgrade is not feasible, disabling the AI table generation feature removes the vulnerable code path entirely at the cost of AI-assisted row generation functionality. For cloud-hosted deployments on AWS, enforcing IMDSv2 (token-required mode) at the EC2 instance level prevents unauthenticated metadata retrieval even if SSRF is successfully triggered, substantially reducing the worst-case impact without requiring application changes. Network-level egress filtering to block outbound requests from the Budibase server process to RFC1918 and link-local ranges (169.254.0.0/16, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) provides a defense-in-depth layer but should not substitute for patching.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaS
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Unauthenticated account takeover of pending invited users in Budibase Server (@budibase/server) versions 3.41.0 through
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today