CVE-2026-48148

The record

Budibase is an open-source low-code platform. Prior to 3.35.3, the VectorDB configuration endpoint in Budibase accepts a host parameter that undergoes no validation against internal IP ranges, reserved hostnames, or URL schemes. Any authenticated user with builder-level access can supply an arbitrary host value such as 169.254.169.254 or localhost, causing the server to initiate outbound TCP connections to internal network addresses or cloud metadata endpoints on their behalf.This vulnerability is fixed in 3.35.3.

Affected packages

Related vulnerabilities

• GHSA-cv96-5348-p5p8 Budibase: Unvalidated VectorDB Host Parameter Enables SSRF Same vulnerability
• GHSA-3gp5-q4jw-3v94 Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting… Also affects @budibase/server
• GHSA-qhv3-wjg8-6fx6 Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of… Also affects @budibase/server
• GHSA-6xp4-cf37-ppjh Budibase: Workspace-scoped builder escalates to global admin via… Also affects @budibase/server
• GHSA-g6qx-g4pr-92v7 Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection Also affects @budibase/server
• CVE-2026-48152 Budibase is an open-source low-code platform. Also affects @budibase/server
• CVE-2026-48150 Budibase is an open-source low-code platform. Also affects @budibase/server
• CVE-2026-48151 Budibase is an open-source low-code platform. Also affects @budibase/server