Loading story…
A server-side request forgery flaw tracked as CVE-2026-48153 was disclosed in Budibase, allowing an authenticated user with builder-role access to abuse the platform's OAuth2 data source configuration and force the backend to send requests to attacker-controlled or internal endpoints. The issue stems from loose Joi URI validation in the Token Endpoint field for a mock OAuth2 data source, enabling requests to internal services such as AWS Instance Metadata Service at 169.254.169.254. When the OAuth authentication flow is triggered, the backend issues a POST request to the supplied endpoint and may expose the response through logs, the client interface, or workspace context, creating a path to credential theft and internal network reconnaissance.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A GitHub pull request documented work to add an auxiliary Metasploit module for CVE-2026-45430, a Backdrop CMS Salesforce CSRF issue. The discussion also shows the item being moved into the Metasploit Kanban board's Todo state.
The vulnerability report states that the fix for CVE-2026-48153 adds blacklist validation and routes outbound requests through a safeFetch wrapper. The same report also notes a suggested mitigation of blocking outbound access to 169.254.169.254 at the network level.
A server-side request forgery vulnerability affecting Budibase's OAuth2 SDK was disclosed as CVE-2026-48153. The issue allows an authenticated builder-role user to direct the backend to attacker-specified internal endpoints, including cloud metadata services, during the OAuth token flow.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Budibase disclosed two high-severity vulnerabilities affecting its low-code platform, including an unrestricted server-side request forgery tracked as `CVE-2026-33226` and a stored cross-site scripting flaw tracked as `CVE-2026-35218`. The SSRF issue affects version `3.30.6` and earlier in the REST datasource query preview endpoint, `POST /api/queries/preview`, where an authenticated admin can supply an arbitrary URL in `fields.path` and force the server to make unvalidated HTTP requests. That behavior can expose internal-only resources such as cloud metadata endpoints, internal databases, Kubernetes APIs, and other internal network services, with reported risk of OAuth2 token theft and potentially full Google Cloud access in some GCP deployments. The second flaw affects versions prior to `3.32.5` and stems from unsanitized entity names rendered with Svelte's `{@html}` directive in the Builder Command Palette. An authenticated user with Builder access can inject malicious HTML into names for tables, views, queries, or automations, and the payload executes when another Builder-role user opens the palette with `Ctrl+K`, enabling session cookie theft and possible full account takeover. Budibase patched the stored XSS issue in version `3.32.5`, while no public patch was available for the SSRF issue at the time of publication.
Jun 29, 2026
Budibase disclosed two high-severity vulnerabilities in its open-source low-code platform that were patched in version **3.33.4**. The most severe issue, **`CVE-2026-35216`**, allows an unauthenticated attacker to trigger an automation through the public webhook endpoint when that automation includes a Bash step, leading to remote code execution as **root inside the container**. The flaw is classified as **CWE-78** and affects Budibase versions prior to 3.33.4. A second flaw, **`CVE-2026-35214`**, affects the plugin file upload endpoint and lets an attacker with **Global Builder** privileges exploit path traversal using `../` in a multipart upload filename. Budibase said the vulnerable filename handling can lead to arbitrary directory deletion via `rmSync` and arbitrary file write through tarball extraction anywhere the Node.js process has access. The issue is classified as **CWE-22**, also affects versions prior to **3.33.4**, and was fixed alongside the webhook RCE in the same release.
Jun 29, 2026
Budibase disclosed seven vulnerabilities affecting versions before **3.40.0**, including **CVE-2026-72851**, a maximum-severity unauthenticated SQL injection in webhook-triggered automations that use `EXECUTE_QUERY` steps. The flaw lets attackers send crafted JSON to public webhook endpoints and run SQL with builder-configured database credentials, creating a path to data theft, unauthorized modification, and persistence in connected data sources such as Snowflake. Budibase said version **3.40.0** remediates the issues and reported no known active exploitation at publication time. The disclosure also includes **CVE-2026-73300**, a MySQL SQL injection tied to `multipleStatements: true`, and **CVE-2026-72853**, an Oracle connector SQL injection in post-write row lookup caused by improper escaping of table names. Additional issues reportedly exposed plaintext MongoDB connection strings and Firebase private keys through the datasource API, enabled cross-workspace automation execution, introduced AI table-generation SSRF, and allowed arbitrary file write via path traversal. Organizations running Budibase were urged to upgrade to **3.40.0**, rotate potentially exposed MongoDB and Firebase credentials, and review webhook exposure and database permissions.
Aug 18, 2026