CVE-2026-100680

Executive Summary

CVE-2026-100680 is a server-side request forgery (SSRF) / arbitrary file read vulnerability in Budibase versions prior to 3.45.0. The OpenAPI/Swagger import validator fails to disable external JSON reference ($ref) resolution, allowing authenticated users with "builder" privileges to embed file:// references in OpenAPI specifications. This enables exfiltration of arbitrary local files, including environment variables containing JWT secrets, API keys, and database credentials.

Technical Analysis

The vulnerability resides in Budibase's OpenAPI/Swagger import validator. When a builder submits an OpenAPI specification to the import endpoint, the validator processes JSON $ref references. In versions before 3.45.0, this resolution mechanism is not restricted to internal/embedded definitions — it permits external schemes such as file://. An attacker can craft an OpenAPI document containing a $ref pointing to a local file path (e.g., file:///etc/passwd or file:///proc/self/environ). During validation/import, the server resolves the reference and returns the file contents within error messages, parsed output, or generated API definitions — resulting in arbitrary local file disclosure.

This is a classic CWE-200 (Exposure of Sensitive Information) issue, specifically a server-side file inclusion/SSRF variant. The attack surface is the OpenAPI import functionality, which is exposed to authenticated builder users. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates network-exploitable with low complexity, requiring low privileges (builder role), no user interaction, and resulting in high confidentiality and integrity impact but no availability impact. The integrity impact (I:H) is notable — it suggests an attacker could potentially modify or inject data through the import process beyond just reading files, though the description emphasizes file read.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class (SSRF/file read via OpenAPI $ref).

1. Reconnaissance: The attacker identifies a Budibase instance (e.g., via Shodan dorks http.title:"Budibase" or by scanning for the application). They need valid credentials with builder-level access to the OpenAPI import feature.

2. Triggering the flaw: The attacker authenticates as a builder and navigates to the OpenAPI/Swagger import functionality. They craft a malicious OpenAPI specification (JSON or YAML) that includes a $ref pointing to a local file, such as {"$ref": "file:///etc/passwd"} or {"$ref": "file:///proc/self/environ"}. This spec is submitted to the import endpoint.

3. Payload execution: During validation, the Budibase backend resolves the external file:// reference without restriction. The file contents are then either returned in the response, reflected in error messages, or embedded in the parsed/generated API definition presented to the attacker.

4. Post-exploitation: The attacker reads sensitive files. Of particular interest are environment variables (accessible via /proc/self/environ on Linux) that may contain JWT secrets, API keys, and database credentials. With these secrets, the attacker can forge JWTs, access backend databases, or pivot to other connected services — escalating from a builder to a full administrative compromise of the Budibase instance and its integrations.

Impact Assessment

The vulnerability allows an authenticated builder to read arbitrary files on the server hosting Budibase. This directly exposes secrets stored in environment variables, including JWT signing keys, third-party API keys, and database connection strings. Compromise of these secrets can lead to:

• Full instance takeover: Forged JWTs can impersonate administrators.
• Data breach: Direct database access exposes all application data.
• Lateral movement: API keys may grant access to external SaaS platforms (e.g., email, storage, payment).
• Integrity compromise: CVSS indicates high integrity impact (I:H), suggesting potential to alter data or configuration through the import mechanism.

The blast radius includes all data and integrations managed by the Budibase instance. Because the attack requires only builder privileges (a relatively common role), the risk is elevated for organizations where builder access is broadly granted.

Detection Guidance

Sigma Rule

title: Budibase OpenAPI Import Arbitrary File Read via file:// Reference
id: 8f3c2b1a-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects submission of OpenAPI/Swagger specifications containing file:// references to the Budibase import endpoint.
author: Threat Intelligence
date: 2026/05/12
logsource:
  product: webserver
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri|contains:
      - '/api/import'
      - '/openapi'
      - '/swagger'
  selection_payload:
    - cs-body|contains: 'file://'
    - cs-body|contains: '$ref'
  condition: selection_method and selection_uri and selection_payload
falsepositives:
  - Legitimate OpenAPI imports referencing external HTTP URLs (not file://)
level: high

YARA Rule

rule CVE_2026_100680_Budibase_OpenAPI_FileRef
{
    meta:
        description = "Detects OpenAPI specifications containing file:// references targeting Budibase import"
        author = "Threat Intelligence"
        date = "2026-05-12"
        reference = "CVE-2026-100680"
        severity = "high"
    strings:
        $s1 = "file://" ascii wide nocase
        $s2 = "$ref" ascii wide
        $s3 = "swagger" ascii wide nocase
        $s4 = "openapi" ascii wide nocase
        $s5 = "/proc/self/environ" ascii wide
        $s6 = "/etc/passwd" ascii wide
    condition:
        ($s1 and $s2) or ($s1 and ($s3 or $s4)) or ($s1 and ($s5 or $s6))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100680 Budibase OpenAPI Import File Reference Exploitation Attempt"; flow:established,to_server; content:"POST"; http_method; content:"file://"; http_client_body; content:"$ref"; http_client_body; classtype:attempted-recon; sid:2026100680; rev:1; metadata:created_at 2026_05_12, cve CVE-2026-100680;)

Elastic Detection

network where
  http.request.method == "POST" and
  (http.request.uri : "*import*" or http.request.uri : "*openapi*" or http.request.uri : "*swagger*") and
  http.request.body : "file://" and
  http.request.body : "$ref"

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=stream:http
| search method=POST (uri="*import*" OR uri="*openapi*" OR uri="*swagger*")
| search form_data="*file://*" form_data="*$ref*"
| table _time, src_ip, dest_ip, uri, method, form_data
| sort - _time

Wazuh OSSEC Rule

<group name="budibase,web,attack,">
  <rule id="100680" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>POST</match>
    <regex>file://.*\$ref|\\$ref.*file://</regex>
    <description>CVE-2026-100680: Budibase OpenAPI import arbitrary file read attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_100680,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict builder-level access to only fully trusted users; audit current builder accounts.
   • If feasible, disable the OpenAPI/Swagger import feature via configuration or by blocking the import endpoint at a reverse proxy/WAF.
   • Deploy WAF rules to block requests containing file:// in the body to import-related endpoints.
   • Monitor for anomalous file read attempts and rotate secrets (JWT keys, API keys, database credentials) if compromise is suspected.

2. Patch/upgrade steps:

   • No official patch is available per tracked sources. Upgrade to Budibase 3.45.0 or later is indicated by the NVD description as the fixed version. Verify availability from the Budibase release channel and apply once released.
   • Monitor Budibase GitHub releases and security advisories for version 3.45.0.

3. Long-term hardening:

   • Implement strict allow-listing for $ref resolution — only permit internal references or explicitly trusted HTTP(S) sources, never file://.
   • Run Budibase with least privilege (containerized, read-only filesystem, no sensitive env vars in plaintext; use secrets management).
   • Enforce network segmentation to limit SSRF and file-read impact.
   • Conduct regular security reviews of import/export features that process user-supplied structured data.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100680
• Budibase GitHub Releases: https://github.com/Budibase/budibase/releases
• Budibase Documentation: https://docs.budibase.com
• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/