CVE-2026-103757

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.41.1

Description An issue exists in the AI table generation feature where the uploadUrl() function in packages/server/src/utilities/fileUtils.ts utilizes raw node-fetch instead of a restricted fetch method. Authenticated builder users can exploit this by sending a prompt to the 'POST /api/ai/tables' endpoint that includes an internal URL in an attachment column. This causes the server to fetch the internal resource and return a presigned object-storage URL containing the response, which may expose sensitive data such as cloud metadata credentials. Server-side request forgery (SSRF) is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations Update Budibase to version 3.41.1 or later. As a temporary mitigation, restrict access to the 'POST /api/ai/tables' endpoint for users who do not require AI table generation capabilities.