CVE-2026-45715: Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration

Synopsis

This is a server-side request forgery (SSRF) bypass affecting Budibase, an open-source low-code platform. An authenticated user with Builder-level access can exploit the REST datasource integration by pointing it at an attacker-controlled server that issues an HTTP redirect to an internal address; Budibase follows the redirect without re-checking its IP blocklist, so the request reaches internal services such as cloud metadata endpoints or internal databases. Successful exploitation grants read access to sensitive internal resources, including cloud provider metadata that can expose instance credentials. No fix version has been published yet; HarborGuard is tracking the upstream advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Budibase server over the network to submit REST datasource requests; the vulnerable endpoint is exposed as a networked service.

• AuthenticationRequired

  A low-privilege Builder account is sufficient; no administrative credentials are needed, but the attacker must be authenticated.

• Victim interactionNot required

  No victim interaction is needed; the attacker triggers the redirect entirely through their own requests to the Budibase API.

• Attack complexityDetail

  Attack complexity is low - the exploit is reliable and condition-free, requiring only that the attacker control a server capable of issuing an HTTP redirect to a target internal address.

Blast Radius

• Reads cloud provider instance metadata endpoints (such as AWS IMDSv1 at 169.254.169.254), potentially exposing IAM role credentials tied to the host instance.
• Reads configuration data or query results from internal databases and services that are reachable from the Budibase server but not intended to be exposed externally.
• Reads internal HTTP APIs (monitoring endpoints, admin panels, service discovery endpoints) that rely on network-level isolation rather than authentication for protection.