https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T20:06:18.033611+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-322233 EUVD-2026-322233 2026-10-03T20:06:18.056490+00:00 EUVD-2026-322233 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48153 fkie_cve-2026-48153 2026-10-03T20:06:18.056530+00:00

Budibase is an open-source low-code platform. Prior to 3.39.0, fetchToken in the OAuth2 SDK makes a POST to a builder-supplied URL with plain node-fetch, skipping the blacklist.isBlacklisted check that every other outbound fetch path in the codebase uses. The Joi schema for the OAuth2 URL has no scheme or host restriction. This vulnerability is fixed in 3.39.0.

 https://cve.radiocsirt.org/vuln/ghsa-4q6h-8p4v-67vq GHSA-4q6h-8p4v-67vq — Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata 2026-10-03T20:06:18.056567+00:00

Affected: npm: @budibase/server

## Summary

`fetchToken` in the OAuth2 SDK makes a POST to a builder-supplied URL with plain node-fetch, skipping the `blacklist.isBlacklisted` check that every other outbound fetch path in the codebase uses. The Joi schema for the OAuth2 URL has no scheme or host restriction. Alice, a builder, points an OAuth2 config at `http://169.254.169.254/...` or `http://127.0.0.1:5984/`; the server connects and returns response-body fragments in the validation result.

## Details

`packages/server/src/sdk/workspace/oauth2/utils.ts:17-65` defines `fetchToken`. Near the end:

```typescript const resp = await fetch(config.url, fetchConfig) ```

`config.url` is whatever the builder stored. `fetchConfig` has `redirect: "follow"` (the default), so a public URL that returns 302 to an internal target is also reachable.

The route validation at `packages/server/src/api/routes/oauth2.ts:9` accepts any string:

```typescript url: Joi.string().required(), ```

The controller passes the URL into `fetchToken` through `crud.ts`. The `/api/oauth2/validate` endpoint (builder role) is the most direct attack path: it lives on `builderRoutes`, takes the URL from the body, fires the fetch, and returns a validation envelope that includes the upstream error string.

Compare with every other outbound fetch in the codebase:

- `packages/server/src/integrations/rest.ts:754` calls `blacklist.isBlacklisted(url)` before its fetch (though it does not re-check redirects; see companion advisory for REST-redirect SSR…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1629 WID-SEC-W-2026-1629 — Budibase: Mehrere Schwachstellen 2026-10-03T20:06:18.056628+00:00

Ein Angreifer kann mehrere Schwachstellen in Budibase ausnutzen, um Administratorrechte zu erlangen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.