CVE-2026-48153: Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata

Synopsis

This is a server-side request forgery (SSRF) vulnerability in Budibase, an open-source low-code platform. A network-accessible attacker with a low-privilege account can supply a crafted URL as the OAuth2 token endpoint, causing the Budibase server to make an outbound HTTP POST to any internal host, including cloud metadata services such as AWS IMDSv1 (169.254.169.254). Successful exploitation reads sensitive internal data and allows limited tampering with internal services. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Budibase API over the network; the vulnerability is exposed on any internet- or intranet-facing Budibase deployment.

• AuthenticationRequired

  Any low-privilege Budibase account is sufficient; no administrative rights are needed to supply a crafted OAuth2 token endpoint URL.

• Victim interactionNot required

  No victim action is needed; the attacker submits the malicious URL directly through the API and the server-side fetch executes automatically.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or specific memory layout is required to trigger the unguarded outbound fetch.

Blast Radius

• Reads responses from internal HTTP services, including cloud instance metadata endpoints (e.g. AWS IMDSv1), potentially exposing IAM credentials, instance identity documents, and environment secrets.
• Reads any plaintext data served by internal hosts that accept unauthenticated HTTP POST requests, such as monitoring endpoints, internal APIs, or container sidecar services.
• Sends attacker-controlled POST body content to internal services, allowing limited manipulation of services that act on inbound POST data without authentication.