Executive brief
Budibase, a platform for building business applications, is vulnerable to a security flaw where users with 'Builder' permissions can force the server to make requests to internal network services. This could allow an attacker to access sensitive internal databases, cloud metadata services containing security credentials, or perform reconnaissance on the private corporate network. The vulnerability specifically affects the OAuth2 configuration validation and REST integration components.
Technical details
Budibase suffers from two SSRF vectors. First, the OAuth2 token fetch function in `packages/server/src/sdk/workspace/oauth2/utils.ts` uses a raw `fetch()` call instead of the internal `fetchWithBlacklist()` wrapper, allowing requests to internal IP addresses. Second, the REST integration in `packages/server/src/integrations/rest.ts` fails to re-validate the blacklist on HTTP redirects when using `undici.fetch()` with `redirect: "follow"`. An attacker with BUILDER role can exploit these to reach internal services like CouchDB or cloud metadata endpoints (169.254.169.254). The issue is resolved in version 3.39.0 by consistently applying the `fetchWithBlacklist` wrapper.
Affected products
- Budibase @budibase/server < 3.39.0
Timeline
- 2026-05-21: disclosed: Initial report to Budibase
- 2026-05-27: advisory: NVD publication date
- 2026-06-12: patched: GitHub Advisory published and reviewed