CVE-2026-103757 in Budibase
Summary
by MITRE • 10/01/2026
Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist. Authenticated builder users can send a prompt to POST /api/ai/tables that places an internal URL in an attachment column, causing the server to fetch it and return a presigned object-storage URL containing the response, such as cloud metadata credentials.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in Budibase versions up to 3.41.0 represents a critical Server-Side Request Forgery (SSRF) flaw located within the AI table generation functionality. This security defect stems from an improper implementation of URL validation and fetching mechanisms in the server-side codebase, specifically within the fileUtils.ts module where the uploadUrl function is defined. The core technical issue arises because this function utilizes raw node-fetch to retrieve content rather than employing a restricted variant such as fetchWithBlacklist that would typically enforce safety checks against internal or private network addresses. By bypassing these essential safeguards, the application fails to validate whether the requested URL points to an external resource or an internal service endpoint before initiating the HTTP request.
Authenticated users with builder-level privileges can exploit this weakness by interacting with the POST /api/ai/tables API endpoint. The attack vector involves submitting a prompt that includes an attachment column configured with a target pointing to an internal URL, such as those found in cloud provider metadata services or local application endpoints. When the server processes this request, it blindly fetches the content from the specified internal address without verifying its legitimacy or origin. This lack of input validation allows attackers to force the server to act as a proxy for arbitrary requests directed at sensitive infrastructure components that are otherwise inaccessible from the public internet.
The operational impact of this vulnerability is severe due to the potential exposure of highly sensitive data, particularly cloud metadata credentials. Cloud providers often host instance metadata services on specific internal IP addresses or localhost endpoints that contain authentication tokens, access keys, and configuration details necessary for managing virtual machines and containers. By leveraging the SSRF flaw, an attacker can retrieve these presigned object-storage URLs which may encapsulate responses containing such critical secrets. This effectively grants unauthorized actors elevated privileges within the cloud environment, potentially leading to full compromise of the underlying infrastructure, data exfiltration, or lateral movement across internal networks.
This vulnerability aligns with CWE-918, Server-Side Request Forgery (SSRF), which describes flaws where a web application fetches a remote resource without validating the user-supplied URL. Furthermore, it maps to MITRE ATT&CK technique T1557, Adversary-in-the-Middle, as the attacker uses the compromised server to intercept or manipulate communications between internal services and external entities, although in this specific case, the primary concern is data exfiltration via metadata retrieval rather than active interception. The exploitation also relates to CWE-200, Exposure of Sensitive Information to an Unauthorized Actor, given that cloud credentials are inadvertently disclosed through the application's response mechanism.
To mitigate this risk, immediate remediation should focus on enforcing strict URL validation and filtering within the fileUtils.ts module. Developers must replace raw node-fetch calls with a secure fetching utility like fetchWithBlacklist or implement custom logic that explicitly blocks requests to private IP ranges, loopback addresses, and cloud metadata endpoints such as 169.254.169.254 for AWS or similar internal service IPs for other providers. Additionally, implementing network-level controls such as egress filtering can prevent the server from initiating connections to unauthorized destinations regardless of application-layer validation failures. Regular security audits focusing on SSRF vectors in AI and data processing modules are recommended to ensure that future updates maintain these critical safety boundaries against evolving attack techniques.