CVE-2026-100681GHSA-942w-fccr-8r3c
server: Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook
budibase server
CVSS
6.3MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 30 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.45.0serverCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an attacker-controlled serviceUrl that is persisted and used for all subsequent bot replies, causing the server to send live Microsoft OAuth access tokens in Authorization headers to the attacker's host and enabling blind internal network access.
Text from CVE List
Affected versions 2
- serveraffected: all versions before 3.45.0CVE List
- serverunaffected: 3.45.0CVE List