All vulnerabilities
CVE-2026-103757GHSA-3c52-v5v2-3r56

Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation

Budibase budibase
Open in ThreatlineRecord JSON
CVSS
8.3High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 1 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.41.0Fixed versionCVE List
Published1 Oct 2026Updated 1 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist. Authenticated builder users can send a prompt to POST /api/ai/tables that places an internal URL in an attachment column, causing the server to fetch it and return a presigned object-storage URL containing the response, such as cloud metadata credentials.

Text from CVE List

Affected versions 2

  • budibaseaffected: all versions before 3.41.0CVE List
  • budibaseunaffected: 3.41.0CVE List

References 2