PT-2026-44064 · Budibase · Budibase

Adrgs · CVE-2026-48153 · Published 2026-05-27 · Updated 2026-06-22

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.0

Description The fetchToken() function in the OAuth2 SDK performs a POST request to a URL provided by the builder using node-fetch. This process bypasses the isBlacklisted check used by all other outbound fetch paths in the codebase. Additionally, the Joi schema for the OAuth2 URL lacks restrictions on the scheme or host.

Recommendations Update to version 3.39.0.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-48153

GHSA-4Q6H-8P4V-67VQ

Affected Products

Budibase

References · 8

• 🔥 https://github.com/Budibase/budibase/security/advisories/GHSA-4q6h-8p4v-67vq · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48153.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-48153 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48153 · Security Note
• https://osv.dev/vulnerability/GHSA-4q6h-8p4v-67vq · Vendor Advisory
• https://github.com/Budibase/budibase · Note
• https://twitter.com/CVEnew/status/2059718145963950192 · Twitter Post
• https://twitter.com/infoflowcloud/status/2059719148565868662 · Twitter Post