CVE-2026-48153 Details
Description
Budibase is an open-source low-code platform. Prior to 3.39.0, fetchToken in the OAuth2 SDK makes a POST to a builder-supplied URL with plain node-fetch, skipping the blacklist.isBlacklisted check that every other outbound fetch path in the codebase uses. The Joi schema for the OAuth2 URL has no scheme or host restriction. This vulnerability is fixed in 3.39.0.
A server-side request forgery (SSRF) vulnerability has been identified in Budibase, an open-source low-code platform, in versions prior to 3.39.0. The issue arises in the OAuth2 SDK's 'fetchToken' function, which makes a POST request to a URL provided by the builder. This request bypasses a crucial blacklist check that is applied to all other outbound fetch operations, leaving internal hosts and cloud metadata accessible. The vulnerability is exacerbated by the Joi schema for the OAuth2 URL, which lacks scheme or host restrictions. As a result, a builder could potentially redirect requests to internal services or cloud metadata endpoints, leading to unauthorized data access.
Users are advised to update to Budibase version 3.39.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2026CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Budibase/budibase/security/advisories/GHSA-4q6h-8p4v-67vq | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Budibase/budibase/security/advisories/GHSA-4q6h-8p4v-67vq | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Budibase | < 3.39.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |