CVE-2026-73307: Budibase SSRF Vulnerability

CVE-2026-73307 Overview

CVE-2026-73307 is a Server-Side Request Forgery (SSRF) vulnerability in Budibase, an open-source low-code platform. Versions prior to 3.39.4 allow a builder-level user to abuse the AI table-generation feature to trigger unvalidated server-side HTTP requests. The uploadUrl function in packages/server/src/utilities/fileUtils.ts used a bare node-fetch call for string attachment values passed through processAttachments in packages/server/src/sdk/workspace/ai/helpers/rows.ts. Because the request bypassed the fetchWithBlacklist validation layer, an attacker could point attachment URLs at internal services or cloud metadata endpoints and have the response stored as an attachment. Budibase resolved the flaw in version 3.39.4.

Critical Impact
Authenticated builders can read internal-network resources and cloud instance metadata, potentially exposing IAM credentials and internal service data through SSRF [CWE-918].

Affected Products

Budibase (all versions prior to 3.39.4)
Self-hosted Budibase server deployments (packages/server)
Cloud-deployed Budibase instances with the AI table-generation feature enabled

Discovery Timeline

2026-08-12 - CVE-2026-73307 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73307

Vulnerability Analysis

The vulnerability is a classic Server-Side Request Forgery classified under [CWE-918]. Budibase's AI table-generation feature accepts attachment values as strings, which the server then fetches to store as file attachments in object storage. The uploadUrl helper in fileUtils.ts imported node-fetch directly and issued the outbound request without any destination filtering.

Because the fetch call had no allowlist or blacklist enforcement, arbitrary URLs supplied through the AI attachment path were resolved from the server's network perspective. This allowed a builder to reach loopback services, RFC1918 addresses, and cloud metadata endpoints such as http://169.254.169.254/latest/meta-data/. The retrieved response body was then persisted as an attachment, giving the attacker a reliable exfiltration channel for the server's read.

Root Cause

The root cause was the direct use of node-fetch instead of the project's fetchWithBlacklist wrapper. fetchWithBlacklist performs DNS resolution checks and blocks requests to internal address ranges and metadata services. The AI attachment code path was added without routing through this hardened wrapper, creating an inconsistent security posture between user-supplied URL handling and other server-side fetch call sites.

Attack Vector

Exploitation requires an authenticated builder account with access to the AI table-generation feature. The attacker crafts an attachment value containing a URL that references an internal target. When processAttachments in packages/server/src/sdk/workspace/ai/helpers/rows.ts invokes uploadUrl, the server fetches the internal resource and stores the raw response as an attachment record that the attacker can subsequently download.

typescript

 import fs from "fs"
-import fetch from "node-fetch"
 import path from "path"
 import { pipeline } from "stream"
 import { promisify } from "util"
 import * as uuid from "uuid"
 
 import { context, objectStore } from "@budibase/backend-core"
+import * as coreUtils from "@budibase/backend-core/utils"
 import { Upload } from "@budibase/types"
 import { ObjectStoreBuckets } from "../constants"

Source: Budibase commit fc8161e. The patch removes the direct node-fetch import in favor of the coreUtils module, which exposes fetchWithBlacklist for validated outbound requests.

Detection Methods for CVE-2026-73307

Indicators of Compromise

Attachment records in Budibase object storage containing content that resembles cloud metadata JSON (for example, IAM role documents or instance identity payloads).
Outbound HTTP requests from the Budibase server process to 169.254.169.254, metadata.google.internal, or 127.0.0.1.
Unusual AI table-generation activity from non-admin builder accounts referencing URL-shaped attachment values.

Detection Strategies

Inspect Budibase application logs for processAttachments and uploadUrl invocations where the input string matches an internal IP range or link-local address.
Enable egress logging on the host or container running Budibase and alert on connections to private CIDR blocks originating from the Node.js process.
Review the object-storage bucket used for Budibase attachments for files with suspicious sizes or content types inconsistent with expected user uploads.

Monitoring Recommendations

Forward Budibase server logs and network flow logs to a centralized analytics platform for correlation of builder actions with outbound requests.
Alert on any request from application workloads to the Instance Metadata Service (IMDS) that does not originate from an approved SDK client.
Track version strings reported by Budibase deployments to identify hosts still running releases prior to 3.39.4.

How to Mitigate CVE-2026-73307

Immediate Actions Required

Upgrade Budibase to version 3.39.4 or later on all self-hosted and containerized deployments.
Restrict builder-role membership and audit accounts that currently have access to the AI table-generation feature.
Rotate any cloud IAM credentials associated with instance roles attached to Budibase hosts if exploitation is suspected.

Patch Information

The fix is available in Budibase Release 3.39.4 and was introduced via Pull Request #18866. Full advisory details are published as GHSA-hfhx-w8p8-4hc7. The patch replaces the direct node-fetch call in uploadUrl with the fetchWithBlacklist helper from @budibase/backend-core/utils.

Workarounds

Disable the AI table-generation feature until the upgrade is completed.
Enforce IMDSv2 with hop limit 1 on AWS EC2 instances hosting Budibase to block metadata retrieval from container workloads.
Deploy an egress proxy or network policy that blocks outbound requests from the Budibase server to loopback, link-local, and RFC1918 destinations.

bash

# Example Kubernetes NetworkPolicy blocking egress to metadata and internal ranges
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: budibase-egress-restrict
spec:
  podSelector:
    matchLabels:
      app: budibase
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 169.254.169.254/32
              - 169.254.170.2/32
              - 10.0.0.0/8
              - 172.16.0.0/12
              - 192.168.0.0/16