Read the docs
TI-2023-13471 Aliases CVE-2023-29010

BudiBase Server-Side Request Forgery vulnerability

Priority MEDIUM 62CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Budibase is a low code platform for creating internal tools, workflows, and admin panels. Versions prior to 2.4.3 (07 March 2023) are vulnerable to Server-Side Request Forgery. This can lead to an attacker gaining access to a Budibase AWS secret key. Users of Budibase cloud need to take no action. Self-host users who run Budibase on the public internet and are using a cloud provider that allows HTTP access to metadata information should ensure that when they deploy Budibase live, their internal metadata endpoint is not exposed.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00647 51st percentileScored 2026-11-07
Fix Fixed budibase (Budibase): 2.4.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Budibasebudibasebefore 2.4.32.4.3Patch availableCNA
  • budibase VendorBudibase Affected before 2.4.3 Fixed in 2.4.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*before 2.4.3VulnerableBudibase
  • cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:* Versions before 2.4.3 Vulnerable ·Budibase

Remediation

  • Fix · CNA budibase (Budibase) Fixed in 2.4.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-29010
  2. 2026-10-19 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 1

Other 1

  • TI-2026-39242 Budibase: Anonymous NoSQL operator injection via published-app query templates CVSS 3.1CRITICAL 10.0
  • TI-2026-24369 Budibase Universal Auth Bypass via Webhook Query Param Injection CVSS 3.1CRITICAL 9.1
  • TI-2026-39244 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload CVSS 3.1CRITICAL 9.6
  • TI-2026-39243 Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override CVSS 3.1CRITICAL 9.6
  • TI-2026-24371 Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist CVSS 3.1CRITICAL 9.9
  • TI-2026-23473 Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets CVSS 3.1CRITICAL 9.6
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences