Budibase: Server-side request forgery in AI table generation

Summary

Budibase contains a server-side request forgery (SSRF) vulnerability in its AI table generation feature. The uploadUrl function fetches URLs without the project's blacklist protection, so internal addresses can be requested. An authenticated builder user can exploit this by placing an internal URL in an attachment column, and the server returns the response content via a presigned storage URL, which can expose cloud metadata credentials.

Affected

• Budibase versions before 3.41.0 (CVE record: affected 0 to < 3.41.0; the CVE description says 'through 3.41.0', so the exact boundary should be confirmed in the vendor advisory)

Fixed in

• Budibase 3.41.0 (according to the CVE record; the fix commit is listed in OSV)

Workaround

• Disable AI table generation if it is not needed.
• Limit builder accounts to the people who need them.
• Restrict outbound requests from the Budibase host to internal and metadata addresses at the network level.
• On cloud VMs, enforce the stricter metadata service settings offered by the provider.

These measures have not been verified against the vendor advisory.

Exploitation

• Authentication with a builder account is required.
• CISA SSVC: exploitation status 'poc', automatable: no.
• Public proof-of-concept status is unconfirmed; one source claims a PoC exists, another reports none.
• Not listed in CISA KEV according to a third-party aggregator.

Our recommendation

• Upgrade Budibase to version 3.41.0 or later.
• Check whether AI table generation is enabled and whether it is needed.
• Review builder accounts and remove unused ones.
• If the instance was exposed, check cloud metadata settings and rotate credentials.
• Note that a related bare-fetch issue (CVE-2026-73307) affects earlier versions; confirm the patched version with the vendor.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-3c52-v5v2-3r56 github.com
• VulnCheck advisory: Budibase SSRF via uploadUrl www.vulncheck.com
• OSV: CVE-2026-103757 osv.dev
• OpenCVE: CVE-2026-103757 app.opencve.io
• CVE-2026-73307 (related bare-fetch issue) app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:24.