Budibase's server component attaches stored REST datasource credentials to outgoing requests before resolving the request URL and does not verify that the destination host matches the datasource's base URL. Because query paths can be absolute URLs or user-supplied parameters, an attacker can direct requests to any host, causing the server to send sensitive credentials to an attacker-controlled endpoint. The execute route for queries is accessible without authentication when published with the PUBLIC role, enabling unauthenticated credential theft. This vulnerability bypasses a previous fix (GHSA-3gp5) that addressed base-URL rewriting but did not add same-origin checks for the query path vector.

An unauthenticated attacker can steal sensitive REST datasource credentials, including Bearer tokens, Basic tokens, and static headers, by causing the Budibase server to send these credentials to an attacker-controlled host. This leads to credential disclosure (CWE-200) and potential unauthorized access to backend services or APIs that rely on these credentials. The vulnerability affects all users of Budibase server versions up to 3.38.1 who publish queries with the PUBLIC role and use REST datasources with stored credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid publishing queries with the PUBLIC role that use REST datasources with stored credentials. Restrict query execution permissions to authenticated and authorized users only. Monitor for updates from Budibase regarding a security patch addressing this host verification flaw.