CVE-2026-48128 Details
Description
Budibase is an open-source low-code platform. Prior to 3.39.0, the executeQuery automation step in Budibase accepts a queryId from automation step inputs and passes it directly to the query execution controller without additional validation. When combined with a REST datasource configured to target internal infrastructure, this creates a server-side request forgery path where automation execution causes the Budibase server to make outbound HTTP requests to attacker-influenced destinations. The automation output then returns the response, potentially exposing internal service data. This vulnerability is fixed in 3.39.0.
A server-side request forgery (SSRF) vulnerability has been identified in Budibase versions prior to 3.39.0. The issue arises in the executeQuery automation step, where the queryId is accepted from automation inputs and passed directly to the query execution controller without proper validation. This flaw can be exploited by an authenticated user with builder-level access, allowing them to create a REST datasource that targets internal infrastructure. When the automation is executed, the Budibase server makes outbound HTTP requests to the specified internal destinations, potentially exposing sensitive internal service data. The vulnerability is particularly concerning in environments where builder access is granted to partially trusted users and where network controls do not restrict outbound HTTP from the Budibase server.
Users are advised to update Budibase to version 3.39.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2026CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Budibase/budibase/security/advisories/GHSA-6964-pp88-6wp9 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Budibase/budibase/security/advisories/GHSA-6964-pp88-6wp9 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Budibase | < 3.39.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |