https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T16:44:19.217964+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-322412 EUVD-2026-322412 2026-10-10T16:44:19.220564+00:00 EUVD-2026-322412 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45715 fkie_cve-2026-45715 2026-10-10T16:44:19.220599+00:00

Budibase is an open-source low-code platform. Prior to 3.38.1, the REST datasource integration (packages/server/src/integrations/rest.ts) follows HTTP redirects without re-checking the IP blacklist, allowing an authenticated Builder to access internal services (cloud metadata, databases) by redirecting through an attacker-controlled server. This vulnerability is fixed in 3.38.1.

 https://cve.radiocsirt.org/vuln/ghsa-fgqv-jh4g-pvg2 GHSA-fgqv-jh4g-pvg2 — Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration 2026-10-10T16:44:19.220631+00:00

Affected: npm: @budibase/server

### Summary

The REST datasource integration follows HTTP redirects without re-checking the IP blacklist, allowing an authenticated Builder to access internal services (cloud metadata, databases) by redirecting through an attacker-controlled server. The same vulnerability class was already patched in automation steps (`fetchWithBlacklist` in `packages/server/src/automations/steps/utils.ts`) but the REST integration was missed.

### Details

**Vulnerable file:** `packages/server/src/integrations/rest.ts`, lines 754-778

The `_req()` method checks the request URL against the IP blacklist at line 754, then calls `fetch(url, input)` at line 778. No `redirect: "manual"` option is set, so undici's fetch defaults to `redirect: "follow"`, automatically following HTTP 301/302/307 redirects **without re-validating the redirect target against the blacklist**.

```typescript // Line 754 — blacklist check on original URL only if (await blacklist.isBlacklisted(url)) { throw new Error("URL is blocked or could not be resolved safely.") }

// Line 778 — fetch follows redirects, NO re-check on redirect target response = await fetch(url, input) ```

The automation steps already implement the correct fix in `packages/server/src/automations/steps/utils.ts` (lines 100-136) via `fetchWithBlacklist()`, which sets `redirect: "manual"` and re-checks the blacklist on every redirect hop. The REST integration does not use this safe wrapper.

Relevant prior fix commits on the automation side: - `6cfa3b…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1477 WID-SEC-W-2026-1477 — Budibase: Mehrere Schwachstellen 2026-10-10T16:44:19.220688+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Budibase ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Code auszuführen oder seine Rechte zu erweitern.