CVE-2026-48153: Budibase SSRF in OAuth2 SDK fetchToken

CVE-2026-48153 · Severity: high · CVSS 8.5 · Published 2026-05-27

Budibase, a low-code platform for building business applications, contains a server-side request forgery (SSRF) vulnerability in its OAuth2 configuration validation. An attacker with builder-level access can supply a malicious OAuth2 token endpoint URL that causes the server to make requests to internal services (such as databases or cloud metadata endpoints) and leak response data. This allows attackers to read other tenants' data on shared Budibase Cloud instances or steal AWS credentials from instance metadata.

Technologies: @budibase/server (npm). Vendors: npm.

Quick answers

Is CVE-2026-48153 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48153 being exploited in the wild.
How severe is CVE-2026-48153?
High severity, with a CVSS score of 8.5, published 27 May 2026.
Which products and versions are affected?
@budibase/server (npm) < 3.39.0, SEMVER:introduced=0,fixed=3.39.0.
Is there a fix for CVE-2026-48153?
Yes. @budibase/server (npm): upgrade to 3.39.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48153 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-48153?
Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @budibase/server (npm): upgrade to 3.39.0 or later
    npm install @budibase/server@3.39.0

Technical details

The vulnerability exists in fetchToken (packages/server/src/sdk/workspace/oauth2/utils.ts) which makes a POST request to a builder-controlled URL using plain node-fetch without consulting blacklist.isBlacklisted(), unlike every other outbound fetch path in the codebase. The /api/oauth2/validate endpoint accepts any URL string via Joi.string().required() with no scheme or host restrictions, and returns validation error messages that leak upstream response bodies. The fetchConfig uses redirect: "follow" (default), enabling attacker chaining through public 302 redirects to internal targets. Successful exploitation requires builder role access (available on Budibase Cloud with free-tier signup). The default blacklist blocks 127.0.0.0/8, 169.254.0.0/16, 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. The fix is to call blacklist.isBlacklisted() before fetch and set redirect: "manual", matching the pattern in outboundFetch.ts. Patched in version 3.39.0.

Affected products

  • Budibase @budibase/server < 3.39.0

Identifiers

  • CVE-2026-48153
  • GHSA-4q6h-8p4v-67vq

Timeline

  • 2026-05-27: disclosed
  • 2026-06-22: patched: Version 3.39.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.