CVE-2026-45061: Budibase: SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`)

Synopsis

A server-side request forgery (SSRF) vulnerability exists in Budibase, an open-source low-code platform, in the Plugin URL upload endpoint (POST /api/plugin). The endpoint validates submitted URLs using only a trivial substring check for `.tar.gz`, allowing any URL containing that string anywhere to bypass validation before being passed to the HTTP fetch layer; a low-privilege authenticated attacker can reach this endpoint over the network with no victim interaction required. Successful exploitation lets an attacker force the Budibase server to make arbitrary outbound HTTP requests to internal infrastructure, disclosing responses from hosts that should not be reachable from outside the network. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Budibase API service over the network; the POST /api/plugin endpoint is an HTTP API exposed to network clients.

• AuthenticationRequired

  A valid low-privilege Budibase account is sufficient; no administrative role is needed to call the Plugin URL upload endpoint.

• Victim interactionNot required

  No user interaction is needed; the attacker submits a crafted URL directly to the API and the server issues the outbound request autonomously.

• Attack complexityDetail

  The exploit is reliable and condition-free in its basic form; bypassing the SSRF blacklist requires either an empty BLACKLIST_IPS configuration or the presence of HTTP redirect-following behavior, both realistic in default deployments.

Blast Radius

• The Budibase server makes outbound HTTP requests to attacker-controlled targets, which can include internal hosts on the same network segment such as metadata services, internal APIs, and management interfaces.
• Responses from internal services are returned to the attacker, exposing credentials, tokens, configuration data, or any content served by the internal host.
• Cloud instance metadata endpoints (for example, AWS IMDSv1 at 169.254.169.254) are reachable via this vector, potentially exposing instance identity credentials and IAM role tokens.
• Integrity and availability of data are not directly affected; the confirmed impact is confidentiality loss through unauthorized reads of internal HTTP resources.