CVE-2026-48153 Overview
CVE-2026-48153 is a Server-Side Request Forgery (SSRF) vulnerability in Budibase, an open-source low-code platform. The flaw exists in the fetchToken function within the OAuth2 SDK. This function issues a POST request to a builder-supplied URL using plain node-fetch, bypassing the blacklist.isBlacklisted check enforced on every other outbound fetch path. The Joi validation schema applied to the OAuth2 URL imposes no scheme or host restriction. Authenticated builders can direct the server to make arbitrary HTTP requests to internal services. The vulnerability is fixed in Budibase version 3.39.0.
Critical Impact
Authenticated attackers can coerce the Budibase server into sending requests to internal network resources, exposing cloud metadata services and internal APIs.
Affected Products
- Budibase versions prior to 3.39.0
- Budibase OAuth2 SDK fetchToken component
- Self-hosted and cloud deployments of Budibase
Discovery Timeline
- 2026-05-27 - CVE-2026-48153 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-48153
Vulnerability Analysis
The vulnerability is classified under [CWE-918] Server-Side Request Forgery. Budibase enforces an allow/deny list for outbound HTTP requests using a blacklist.isBlacklisted helper. This helper inspects target URLs and rejects requests destined for internal address ranges, link-local addresses, and cloud metadata endpoints.
The OAuth2 SDK's fetchToken function bypasses this control. It uses node-fetch directly to POST against any URL supplied at OAuth2 configuration time. The input validation layer relies on a Joi schema that does not constrain the URL scheme or host. A builder-role user can supply a URL pointing to localhost, an internal RFC1918 address, or a cloud instance metadata service.
Attackers with builder access can read responses from internal HTTP services. Cloud deployments are exposed to credential theft through metadata endpoints such as 169.254.169.254.
Root Cause
The root cause is inconsistent enforcement of the outbound URL blacklist. Other fetch wrappers in the Budibase codebase route through a validated client that calls blacklist.isBlacklisted before sending the request. The OAuth2 token retrieval path uses raw node-fetch, skipping this gate. A permissive Joi schema compounds the problem by allowing arbitrary hosts and schemes.
Attack Vector
Exploitation requires network access to the Budibase application and an authenticated account with builder privileges. The attacker configures an OAuth2 integration with a malicious token URL pointing at an internal resource. When the OAuth2 flow triggers fetchToken, the server issues an attacker-controlled POST request and returns response data through the application interface. See the GitHub Security Advisory for additional technical context.
Detection Methods for CVE-2026-48153
Indicators of Compromise
- Outbound HTTP requests from the Budibase application server to internal IP ranges (RFC1918, 127.0.0.0/8, 169.254.0.0/16).
- Unexpected OAuth2 integration configurations referencing internal hostnames, loopback addresses, or cloud metadata endpoints.
- Application logs showing fetchToken invocations against non-standard OAuth2 token endpoints.
Detection Strategies
- Inspect Budibase audit logs for OAuth2 configuration changes that include unusual or internal URLs.
- Monitor egress traffic from Budibase hosts and alert on connections to instance metadata addresses or private networks.
- Review reverse proxy and web server logs for OAuth2 callback URLs that deviate from approved identity providers.
Monitoring Recommendations
- Enable network flow logging on the Budibase application subnet and baseline expected OAuth2 provider destinations.
- Alert on any process originating connections to 169.254.169.254, metadata.google.internal, or equivalent cloud metadata endpoints.
- Correlate builder account activity with outbound HTTP traffic spikes from the Budibase server.
How to Mitigate CVE-2026-48153
Immediate Actions Required
- Upgrade Budibase to version 3.39.0 or later, which restores the blacklist check in the OAuth2 SDK.
- Audit existing OAuth2 integration configurations and remove any referencing internal or unexpected hosts.
- Restrict builder-role assignments to trusted users until patching is complete.
Patch Information
The vulnerability is fixed in Budibase 3.39.0. The fix routes fetchToken through the same blacklist.isBlacklisted validation used by other outbound fetch paths. Refer to the Budibase GitHub Security Advisory GHSA-4q6h-8p4v-67vq for release details.
Workarounds
- Place Budibase behind an egress proxy that blocks connections to RFC1918, loopback, and cloud metadata addresses.
- Apply network policies or security groups that restrict the Budibase server to required external OAuth2 provider endpoints only.
- Require IMDSv2 on AWS deployments to mitigate metadata credential theft if SSRF occurs.
# Example iptables rules to block metadata and internal egress from Budibase host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
