CVE-2026-103757

7.7 HIGHpublic exploit available

Published 2026-10-01 · Updated 2026-10-01

AI risk analysis

Summary: The flaw allows authenticated users to exploit a server-side request forgery vulnerability to fetch internal URLs, potentially leading to credential exposure.
Exploitability: Exploitation requires an authenticated builder user and knowledge of internal URLs. The vulnerability is relatively easy to exploit given the preconditions.
Blast radius: If exploited, the vulnerability could lead to unauthorized access to internal resources and potential credential theft.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Budibase 3.42.0 or later.

srfauthwebfetch

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist. Authenticated builder users can send a prompt to POST /api/ai/tables that places an internal URL in an attachment column, causing the server to fetch it and return a presigned object-storage URL containing the response, such as cloud metadata credentials.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weaknesses

CWE-918

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.