VulnSocial

CVE-2026-48146Disclosure

LOWCVSS 7.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Budibase is an open-source low-code platform. Prior to 3.39.0, the OAuth2 token fetch function in packages/server/src/sdk/workspace/oauth2/utils.ts uses raw fetch(config.url) with no SSRF protection. The safe wrapper fetchWithBlacklist() exists in the same codebase and is used in every other outbound HTTP call (automation steps, plugin downloads, object store), but was not applied to the OAuth2 token endpoint. A user with BUILDER role can point the OAuth2 token URL to internal services (CouchDB, cloud metadata) to exfiltrate sensitive data. This vulnerability is fixed in 3.39.0.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked 1d ago at 2 mentions (2026-05-27); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-05-27: 2Mentions · 2026-06-22: 1Patch / Workaround · 2026-05-27: 1Technical Details · 2026-05-27: 2Technical Details · 2026-06-22: 105-2706-22
Signal classification1 categories
Disclosure
3100.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-05-272
Disclosure2
2026-06-221
Disclosure1
Full discourse3 posts
  • DailyCVE@dailycve
    Disclosure

    🔴 Budibase OAuth2 SDK Server-Side Request Forgery (SSRF), #CVE-2026-48146 (High) -DC-Jun2026-563 https://dailycve.com/budibase-oauth2-sdk-server-side-request-forgery-ssrf-cve-2026-48146-high-dc-jun2026-563/

    Post summary

    A new high‑severity SSRF vulnerability in the Budibase OAuth2 SDK (CVE‑2026‑48146) has been disclosed, but no PoC, exploit code, patch, or active exploitation details are provided.

    0000043
    216 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-48146 Budibase is an open-source low-code platform. Prior to 3.39.0, the OAuth2 token fetch function in packages/server/src/sdk/workspace/oauth2/utils.ts uses raw fetch(con… https://www.cve.org/CVERecord?id=CVE-2026-48146 ----- Traducción: CVE-2026-48146 Bud… http://infoflow.cloud`

    Post summary

    A Budibase CVE is disclosed, describing an OAuth2 token fetch flaw in versions prior to 3.39.0, with no PoC or active exploitation reported.

    0000039
    79 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-48146 Budibase is an open-source low-code platform. Prior to 3.39.0, the OAuth2 token fetch function in packages/server/src/sdk/workspace/oauth2/utils.ts uses raw fetch(con… https://www.cve.org/CVERecord?id=CVE-2026-48146

    Post summary

    CVE‑2026‑48146 reveals a flaw in Budibase’s OAuth2 token fetch prior to v3.39.0; the issue is addressed in version 3.39.0 onward.

    00000167
    57.5K followersView on X

Explore more

Back to dashboard