CVE-2026-48146: Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection

Synopsis

This is a server-side request forgery (SSRF) vulnerability in Budibase, an open-source low-code platform. The OAuth2 token fetch function makes outbound HTTP requests using raw fetch() with no SSRF protection, allowing an authenticated user with BUILDER role to point the OAuth2 token URL at internal services such as CouchDB or cloud metadata endpoints. Successful exploitation lets an attacker read sensitive data from internal network services that the Budibase server can reach. A fix was introduced in Budibase 3.39.0, and a patched-image rebuild is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Budibase server over the network to interact with the OAuth2 configuration interface.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker must hold the BUILDER role within the Budibase instance.

• Victim interactionNot required

  No victim interaction is needed; the attacker submits the malicious OAuth2 URL directly through the application interface.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors are required to redirect the token fetch to an internal target.

Blast Radius

• Reads responses from internal HTTP services the Budibase server can reach, such as CouchDB credentials or database contents.
• Reads cloud instance metadata endpoints (for example, AWS IMDSv1 or GCP metadata server), potentially exposing IAM credentials or environment secrets.
• Exfiltrates any data returned by internal services on ports reachable from the Budibase container's network namespace.
• Confidentiality impact is rated High; integrity and availability of services are not directly affected by this vulnerability.