CVE-2026-48146
Last modified
CVE-2026-48146 is a high-severity vulnerability rated 7.7/10 on the CVSS scale. Budibase is an open-source low-code platform. Prior to 3.39.0, the OAuth2 token fetch function in packages/server/src/sdk/workspace/oauth2/utils.ts uses raw fetch(config.url) with no SSRF protection. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
Budibase is an open-source low-code platform. Prior to 3.39.0, the OAuth2 token fetch function in packages/server/src/sdk/workspace/oauth2/utils.ts uses raw fetch(config.url) with no SSRF protection. The safe wrapper fetchWithBlacklist() exists in the same codebase and is used in every other outbound HTTP call (automation steps, plugin downloads, object store), but was not applied to the OAuth2 token endpoint. A user with BUILDER role can point the OAuth2 token URL to internal services (CouchDB, cloud metadata) to exfiltrate sensitive data. This vulnerability is fixed in 3.39.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-48146?
How severe is CVE-2026-48146?
How do I fix CVE-2026-48146?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-48139There is a NULL pointer dereference vulnerability in NI grpc…8.7
- CVE-2026-48140There is an unchecked enum cast vulnerability in NI grpc-dev…7.1
- CVE-2026-48141There is a memory leak in NI grpc-device BeginSidebandStream…7.5
- CVE-2026-48142NGINX Plus and NGINX Open Source have a vulnerability in the…6.3
- CVE-2026-48144Improper Validation of Certificate with Host Mismatch vulner…9.1
- CVE-2026-48145Improper Validation of Certificate with Host Mismatch vulner…7.5
- CVE-2026-48147Budibase is an open-source low-code platform. Prior to 3.35.…6.5
- CVE-2026-48148Budibase is an open-source low-code platform. Prior to 3.35.…5.3
- CVE-2026-48149Budibase is an open-source low-code platform. Prior to 3.39.…8.1
- CVE-2026-4815A SQL Injection vulnerability has been found in Support Boar…8.8
- CVE-2026-48150Budibase is an open-source low-code platform. Prior to 3.39.…9
- CVE-2026-48151Budibase is an open-source low-code platform. Prior to 3.39.…7.5
Are you affected by CVE-2026-48146?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST