CVE-2026-48153CWE-918

Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata

High · published May 27, 2026

CVSS v3.1
8.5
EPSS
0%
Percentile
20.4
In the wild
Unconfirmed
What it is

Budibase is an open-source low-code platform. Prior to 3.39.0, fetchToken in the OAuth2 SDK makes a POST to a builder-supplied URL with plain node-fetch, skipping the blacklist.isBlacklisted check that every other outbound fetch path in the codebase uses. The Joi schema for the OAuth2 URL has no scheme or host restriction. This vulnerability is fixed in 3.39.0.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00290 · 20.4th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-05-27T16:52Z
EPSS history
Timeline
  • 27 MAY 16:52Z
    Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata
    cvelistv5