PT-2026-44059
CVE-2026-48148
·
Published
2026-05-27
·
Updated
2026-06-12
Description by
CVSS 4.0
5.3
MediumMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
Budibase versions prior to 3.35.3
Description
The VectorDB configuration endpoint accepts a
host parameter that lacks validation against internal IP ranges, reserved hostnames, or URL schemes. This allows an authenticated user with builder-level access to provide arbitrary host values, such as localhost or 169.254.169.254, forcing the server to initiate outbound TCP connections to internal network addresses or cloud metadata endpoints.Recommendations
Update to version 3.35.3.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾