Description
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to attacker-controlled servers, gaining full database access in cloud deployments.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| budibase | server | < 3.41.3 | 3.41.3 |
Advisories 1
- WID-SEC-2026-2849 Budibase: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 30, 2026
References
- GitHub Security Advisory (GHSA-83m5-fvmg-r7xv) vendor-advisory
- VulnCheck Advisory: Budibase Server before 3.41.3 SSRF with Credential Leakage third-party-advisory