PT-2026-44057 · Budibase · Budibase

Axel-Corsiez · Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-48146

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.0

Description The OAuth2 token fetch function in packages/server/src/sdk/workspace/oauth2/utils.ts uses a raw fetch(config.url) call without Server-Side Request Forgery (SSRF) protection. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. While a safe wrapper fetchWithBlacklist() is used for other outbound HTTP calls, it was not applied to the OAuth2 token endpoint. A user with the BUILDER role can point the OAuth2 token URL to internal services, such as CouchDB or cloud metadata, to exfiltrate sensitive data.

Recommendations Update to version 3.39.0.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-48146

Affected Products

Budibase

References · 4

• 🔥 https://github.com/Budibase/budibase/security/advisories/GHSA-g6qx-g4pr-92v7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-48146 · Security Note
• https://twitter.com/CVEnew/status/2059718139697598837 · Twitter Post
• https://twitter.com/infoflowcloud/status/2059719116378820650 · Twitter Post