CVE-2026-48146 Details

A server-side request forgery (SSRF) vulnerability has been identified in Budibase versions prior to 3.39.0. The issue arises in the OAuth2 token fetch function, which uses raw fetch requests without proper SSRF protection. This vulnerability allows users with the BUILDER role to redirect the OAuth2 token URL to internal services, such as CouchDB or cloud metadata, potentially exfiltrating sensitive data. The vulnerability exists because the safe fetch wrapper, fetchWithBlacklist(), was not applied to the OAuth2 token endpoint, despite being used for all other outbound HTTP calls.

Users should update Budibase to version 3.39.0 or later, where this vulnerability has been fixed. Additionally, the OAuth2 token fetch function should be modified to use the fetchWithBlacklist() wrapper instead of raw fetch, and the same change should be applied to the REST integration handling redirects.