PT-2026-44056 · Budibase · Budibase

Fg0X0 · Published 2026-05-27 · Updated 2026-06-12 · CVE-2026-48128

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.0

Description The executeQuery automation step accepts a queryId from automation step inputs and passes it to the query execution controller without additional validation. When a REST datasource is configured to target internal infrastructure, this allows for server-side request forgery (SSRF), a flaw where the server is coerced into making outbound HTTP requests to destinations influenced by an attacker. The automation output then returns the response, which can expose internal service data.

Recommendations Update to version 3.39.0.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-48128

GHSA-6964-PP88-6WP9

Affected Products

Budibase

References · 7

• 🔥 https://github.com/Budibase/budibase/security/advisories/GHSA-6964-pp88-6wp9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-48128 · Security Note
• https://osv.dev/vulnerability/GHSA-6964-pp88-6wp9 · Vendor Advisory
• https://github.com/Budibase/budibase · Note
• https://twitter.com/infoflowcloud/status/2059719083281531346 · Twitter Post
• https://twitter.com/CVEnew/status/2059718138644795889 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1u3zcij/resumen_diario_de_vulnerabilidades_12062026 · Reddit Post