CVE-2026-45061: Budibase SSRF via URL validation bypass in Plugin upload

CVE-2026-45061 · Severity: high · CVSS 7.7 · Published 2026-05-27

Budibase, a low-code platform for building business applications, is vulnerable to a security flaw in how it handles plugin installations from web addresses. An attacker with basic developer permissions can trick the server into making requests to internal systems that should be private, such as cloud metadata services or internal databases. This could lead to the theft of sensitive credentials or internal data, potentially compromising the underlying infrastructure where Budibase is hosted.

Technologies: budibase (npm). Vendors: npm.

Quick answers

Is CVE-2026-45061 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45061 being exploited in the wild.
How severe is CVE-2026-45061?
High severity, with a CVSS score of 7.7, published 27 May 2026.
Which products and versions are affected?
budibase (npm) <= 3.34.11, SEMVER:introduced=0,fixed=3.35.10.
Is there a fix for CVE-2026-45061?
Yes. budibase (npm): upgrade to 3.35.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45061 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-45061?
Check whether you run budibase (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • budibase (npm): upgrade to 3.35.10 or later
    npm install budibase@3.35.10

Technical details

The Plugin URL upload endpoint (`POST /api/plugin`) in Budibase (Self-Hosted) versions <= 3.34.11 performs inadequate URL validation by only checking if the string contains the substring '.tar.gz'. This allows an attacker with 'Global Builder' privileges to bypass the check using crafted URLs like 'http://169.254.169.254/.tar.gz'. While Budibase employs an IP blacklist, this protection can be bypassed if the blacklist is misconfigured (empty) or if the server follows HTTP redirects from an external allowed domain to an internal blocked IP. Successful exploitation allows an attacker to perform GET requests against internal services, cloud metadata endpoints (IMDS), or local databases. The issue is fixed in version 3.35.10.

Affected products

  • Budibase Budibase <= 3.34.11

Identifiers

  • CVE-2026-45061
  • GHSA-xh5j-727m-w6gg

Timeline

  • 2026-03-30: other: Vulnerability identified in version 3.34.11
  • 2026-05-07: advisory: GitHub Advisory published
  • 2026-05-11: disclosed: CVE-2026-45061 disclosed
  • 2026-06-08: other: Advisory updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.