CVE-2026-48128: Budibase SSRF via User-Controlled queryId in Automation Execute Query Step
Summary
CVE-2026-48128: Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step. Affects budibase versions < 3.39.0. Fixed in 3.39.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Budibase is an open-source low-code platform designed to help users build internal tools and applications quickly. It allows users to create custom applications by connecting to various data sources, including REST APIs. However, Budibase has a vulnerability that can be exploited by users with builder-level access, potentially leading to unauthorized access to internal services.
Vulnerability Detail
The vulnerability arises from the executeQuery automation step in Budibase, which accepts a user-controlled queryId and passes it directly to the query execution controller without adequate validation. This flaw enables an attacker with builder-level access to configure a REST datasource that targets internal infrastructure. When the automation is triggered, the Budibase server can make outbound HTTP requests to attacker-controlled destinations, potentially exposing sensitive internal service data. The lack of validation for the queryId and associated parameters allows for server-side request forgery (SSRF), which can lead to significant data exposure.
How To Fix
Latest published version: 0.0.31 as of 23 Oct 2026
npm install budibase@0.0.31Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.39.0
This is the first release that contains the fix.
npm install budibase@3.39.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict builder-level access to trusted users only. Additionally, implement network-level controls to limit outbound HTTP requests from the Budibase server to prevent unauthorized access to internal services.
Conclusion
CVE-2026-48128 is a significant vulnerability in Budibase that allows SSRF attacks through improperly validated user inputs. It is crucial for users with builder-level access to update to the latest version of Budibase and implement necessary access controls to mitigate potential risks.
See every vulnerability recorded for budibase →
FAQ
CVE-2026-48128 is a vulnerability in Budibase that allows server-side request forgery (SSRF) through a user-controlled queryId in the automation execute query step.
Any Budibase application that allows builder-level access to users is potentially affected, especially if they can create REST datasources targeting internal services.
The vulnerability can lead to unauthorized access to internal services and exposure of sensitive data through SSRF attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.1, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for budibase.
