VulnerabilityPublished 07/24/2026

Server: Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak

Affects @budibase/serverSource GCVE Database

Severity

Critical

Rated by Threat Radar

What to do

AI-suggested

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid publishing queries with the PUBLIC role that use REST datasources with stored credentials. Restrict query execution permissions to authenticated and authorized users only. Monitor for updates from Budibase regarding a security patch addressing this host verification flaw.

Affected software

Product	Affected	Fixed in
npm@budibase/server	Affected <=3.38.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

Budibase server versions up to 3.38.1 have a critical vulnerability where stored REST datasource credentials (Bearer/Basic tokens and static headers) are attached to outgoing requests without verifying the destination host. This allows an unauthenticated attacker to craft a query with a request path pointing to an attacker-controlled server, causing the server to leak sensitive credentials. The vulnerability is exploitable via the public role, requiring only one HTTP request. Credentials are masked in the API but can be recovered in cleartext through this flaw.

Summary

Budibase's server component attaches stored REST datasource credentials to outgoing requests before resolving the request URL and does not verify that the destination host matches the datasource's base URL. Because query paths can be absolute URLs or user-supplied parameters, an attacker can direct requests to any host, causing the server to send sensitive credentials to an attacker-controlled endpoint. The execute route for queries is accessible without authentication when published with the PUBLIC role, enabling unauthenticated credential theft. This vulnerability bypasses a previous fix (GHSA-3gp5) that addressed base-URL rewriting but did not add same-origin checks for the query path vector.

Impact

An unauthenticated attacker can steal sensitive REST datasource credentials, including Bearer tokens, Basic tokens, and static headers, by causing the Budibase server to send these credentials to an attacker-controlled host. This leads to credential disclosure (CWE-200) and potential unauthorized access to backend services or APIs that rely on these credentials. The vulnerability affects all users of Budibase server versions up to 3.38.1 who publish queries with the PUBLIC role and use REST datasources with stored credentials.

Weaknesses

CWE-200Information Exposure (opens in a new tab)

What to do

Affected software

Description

AnalysisAI-generated, updated 07/25/2026, 23:56:41 UTC

Technical details

Weaknesses

References

Related threats