CVE-2026-103757: Budibase SSRF Vulnerability

CVE-2026-103757 Overview

CVE-2026-103757 is a server-side request forgery (SSRF) vulnerability in Budibase through version 3.41.0. The flaw resides in the uploadUrl function in packages/server/src/utilities/fileUtils.ts, which uses raw node-fetch instead of the fetchWithBlacklist wrapper. Authenticated builder users can send a prompt to POST /api/ai/tables that places an internal URL in an attachment column. The Budibase server then fetches the attacker-supplied URL and returns a presigned object-storage URL containing the response body. This allows retrieval of sensitive internal resources, including cloud instance metadata credentials.

Critical Impact
Authenticated builder users can coerce the Budibase server to fetch arbitrary internal URLs and read responses, including cloud metadata credentials, through the AI table generation endpoint.

Affected Products

Budibase versions up to and including 3.41.0
Self-hosted Budibase deployments on cloud infrastructure (AWS, Azure, GCP)
Budibase instances exposing /api/ai/tables to builder-role users

Discovery Timeline

2026-10-01 - CVE-2026-103757 published to the National Vulnerability Database
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-103757

Vulnerability Analysis

The vulnerability is a classic SSRF categorized under [CWE-918]. Budibase includes a protective wrapper, fetchWithBlacklist, intended to block requests to internal or sensitive network destinations. The uploadUrl function in packages/server/src/utilities/fileUtils.ts bypasses this control by invoking raw node-fetch directly. Any input routed through uploadUrl therefore avoids the blacklist and reaches arbitrary hosts.

The AI table generation feature at POST /api/ai/tables lets a builder user submit a natural language prompt that defines a new table schema. When the prompt references an attachment column with a URL value, the server fetches that URL via the unsafe uploadUrl path. The fetched content is written to object storage and returned to the caller as a presigned URL, giving the attacker direct access to the response body.

Root Cause

The root cause is inconsistent use of outbound-request controls. The project standardized on fetchWithBlacklist to filter SSRF-prone destinations, but uploadUrl was not migrated to use it. This created a code path that violates the project's own SSRF defense model.

Attack Vector

An attacker with builder privileges authenticates to the Budibase application. The attacker calls POST /api/ai/tables with a prompt that generates an attachment column populated with a target URL, such as the cloud metadata endpoint http://169.254.169.254/latest/meta-data/iam/security-credentials/. The server fetches the URL, stores the response, and returns a presigned object-storage URL. The attacker downloads the response and extracts internal data or temporary cloud credentials. See the GitHub Security Advisory GHSA-3c52-v5v2-3r56 and the VulnCheck Budibase SSRF Advisory for additional technical detail.

Detection Methods for CVE-2026-103757

Indicators of Compromise

Outbound HTTP requests from the Budibase server process to RFC1918 ranges, 127.0.0.0/8, or cloud metadata addresses such as 169.254.169.254 and fd00:ec2::254.
Entries in Budibase application logs showing calls to POST /api/ai/tables immediately followed by presigned-URL generation for small text objects.
Object-storage objects whose contents match cloud metadata response formats, IAM role names, or AWS temporary credential JSON.

Detection Strategies

Inspect reverse-proxy and application access logs for authenticated POST /api/ai/tables requests whose request bodies contain internal IPs, hostnames, or metadata URLs.
Monitor the Budibase container's egress traffic for connections to link-local, loopback, or private network destinations that should never be contacted by the application.
Correlate AI table generation events with subsequent GET requests against newly created presigned object-storage URLs by the same user.

Monitoring Recommendations

Enable cloud provider audit logging (CloudTrail, Azure Activity Log, GCP Audit Logs) and alert on use of IAM credentials sourced from the Budibase instance from unexpected IPs.
Forward Budibase application and web server logs to a centralized log platform and build alerts on anomalous builder-user activity.
Enforce IMDSv2 on AWS and alert on IMDSv1 responses served to the Budibase host.

How to Mitigate CVE-2026-103757

Immediate Actions Required

Upgrade Budibase to a version later than 3.41.0 that routes uploadUrl through fetchWithBlacklist.
Rotate any cloud IAM credentials, API tokens, or secrets reachable from the Budibase instance's metadata service or internal network.
Audit builder-role accounts and remove unused or over-privileged users with access to AI table generation.

Patch Information

Budibase addressed the vulnerability by replacing the raw node-fetch call inside uploadUrl with the project's fetchWithBlacklist wrapper, which rejects requests targeting internal and metadata addresses. Refer to the GitHub Security Advisory GHSA-3c52-v5v2-3r56 for the fixed version and commit references.

Workarounds

Enforce AWS IMDSv2 and set hop limit to 1 to block containerized SSRF from reaching the metadata service.
Place Budibase behind an egress proxy or network policy that denies traffic to RFC1918, loopback, and link-local destinations.
Temporarily restrict access to POST /api/ai/tables at the reverse proxy until the patch is deployed.

bash

# Example: enforce IMDSv2 and limit hop count on an EC2 instance hosting Budibase
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled