CVE-2026-73407: Budibase SSRF Vulnerability

CVE-2026-73407 Overview

CVE-2026-73407 is a credential exposure vulnerability in Budibase, an open-source low-code platform. Versions prior to 3.40.1 fail to validate the final request destination when the REST integration attaches authentication credentials. An unauthenticated attacker can invoke a public query endpoint and redirect the outbound request to an attacker-controlled host. The server transmits the stored bearer token, basic authentication credentials, or static header values to the malicious destination. The issue is tracked under [CWE-22] and was fixed in Budibase 3.40.1.

Critical Impact
Unauthenticated remote attackers can exfiltrate stored datasource credentials by triggering public queries that redirect outbound REST requests to attacker-controlled endpoints.

Affected Products

Budibase versions prior to 3.40.1
packages/server/src/integrations/rest.ts REST integration component
Datasources configured with bearer, basic, or static-header authentication

Discovery Timeline

2026-08-12 - CVE-2026-73407 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73407

Vulnerability Analysis

The vulnerability resides in the RestIntegration._req function inside packages/server/src/integrations/rest.ts. The function attaches credentials returned by getAuthHeaders and defaultHeaders to every outbound HTTP request. It does not verify that the final request destination matches the origin of the configured datasource. An attacker who can reach the public query endpoint POST /api/v2/queries/:queryId can supply an absolute URL or a parameterized path that resolves to an attacker-controlled host. The Budibase server then forwards the datasource's stored authentication material to that host, leaking bearer tokens, basic authentication credentials, and static header secrets.

Root Cause

The root cause is missing origin validation on outbound REST requests. The integration trusts the caller-supplied path without confirming it resolves to the datasource origin. Combined with public query exposure, this allows unauthenticated callers to influence the destination while the server still attaches credentials scoped to the original datasource.

Attack Vector

Exploitation requires only network access to a Budibase deployment that exposes a public query using an authenticated REST datasource. The attacker sends a crafted request to POST /api/v2/queries/:queryId supplying a path parameter that points to an external host. The server issues the outbound request with the stored credentials attached, delivering the secrets to the attacker's listener.

typescript

// Patch excerpt: packages/server/src/integrations/rest.ts
  getUrl(
-    path: string,
-    queryString: string,
+    path = "",
+    queryString = "",
     pagination?: PaginationConfig,
     paginationValues?: PaginationValues
   ): string {
// Source: https://github.com/Budibase/budibase/commit/8b1bca71501b11c68310351ef4f2c3028b2d5f08

The patch also introduces a rejectCrossOriginRedirects option in packages/backend-core/src/utils/outboundFetch.ts to prevent follow-on credential leakage during HTTP redirects. See the GitHub Security Advisory GHSA-mqhr-6j6h-74p5 for the vendor description.

Detection Methods for CVE-2026-73407

Indicators of Compromise

Outbound HTTP requests from Budibase servers to hosts that do not match any configured datasource origin.
Requests to POST /api/v2/queries/:queryId containing absolute URLs or path parameters resolving to external domains.
Authorization headers, bearer tokens, or static API keys appearing in traffic destined for untrusted hosts.

Detection Strategies

Inspect Budibase access logs for public query invocations that include user-supplied absolute URLs or unusual path parameters.
Compare outbound request destinations from the Budibase backend against the allowlist of configured datasource hostnames.
Alert on HTTP redirect chains from datasource origins to third-party hosts where credentials were forwarded.

Monitoring Recommendations

Enable egress logging on the Budibase server and forward events to a centralized analytics platform for correlation.
Rotate any bearer, basic, or static-header credentials used in REST datasources if pre-patch invocations of public queries are observed.
Track version telemetry to confirm all Budibase instances run 3.40.1 or later.

How to Mitigate CVE-2026-73407

Immediate Actions Required

Upgrade Budibase to version 3.40.1 or later using the GitHub Release 3.40.1 artifacts.
Rotate all bearer tokens, basic authentication credentials, and static headers stored in REST datasources.
Audit every public query and disable those that are not strictly required for anonymous access.

Patch Information

The fix is delivered in Budibase 3.40.1 via pull request #19239 and commit 8b1bca7. The patch enforces origin checks on outbound REST requests and adds the rejectCrossOriginRedirects option to outboundFetch to block credential forwarding across origins.

Workarounds

Remove public exposure from queries that rely on authenticated REST datasources until the upgrade is applied.
Restrict egress from Budibase servers to an explicit allowlist of datasource hostnames at the network layer.
Replace long-lived bearer tokens with short-lived, narrowly scoped credentials to limit blast radius.

bash

# Upgrade Budibase self-hosted deployment to the patched release
docker pull budibase/budibase:3.40.1
docker compose down
docker compose up -d

# Verify the running version
curl -s http://localhost:10000/api/system/status | grep version