CVE-2026-100681

Executive Summary

CVE-2026-100681 is an unauthenticated server-side request forgery (SSRF) with credential exfiltration in Budibase, an open-source low-code application development platform. Versions before 3.45.0 expose a Microsoft Teams webhook endpoint that accepts forged Bot Framework activities containing attacker-controlled serviceUrl values. An unauthenticated attacker can inject a malicious serviceUrl that is persisted and subsequently used for all bot replies, causing the server to transmit live Microsoft OAuth access tokens in Authorization headers to the attacker's host, while also enabling blind access to internal network resources. The vulnerability is rated CVSS 3.1 base score 5.4 and has no public PoC, no Nuclei template, and no confirmed patch evidence from tracked sources.

Technical Analysis

The flaw resides in the Microsoft Teams webhook integration endpoint of the Budibase server. Microsoft Teams bot integrations operate by receiving "activities" — structured JSON payloads conforming to the Bot Framework schema — and replying to them by POSTing responses back to a serviceUrl supplied within the incoming activity. The Bot Framework protocol design assumes the serviceUrl originates from Microsoft's trusted infrastructure. The Budibase implementation, prior to 3.45.0, fails to validate or restrict this value.

The vulnerability class is CWE-918 (Server-Side Request Forgery). Two distinct weaknesses compound here:

1. Unvalidated serviceUrl acceptance and persistence. The webhook endpoint accepts forged Bot Framework activities with arbitrary serviceUrl values. Critically, the injected value is persisted rather than being used only transiently for the current request. This means a single successful injection poisons the stored configuration used for all subsequent bot replies, not just the triggering request.

2. Authenticated outbound requests to attacker-controlled hosts. Because the server believes it is communicating with Microsoft's Bot Framework, it attaches live Microsoft OAuth access tokens in Authorization headers to its outbound replies. When the serviceUrl points to an attacker-controlled host, those tokens are delivered directly to the adversary. This transforms a generic SSRF primitive into a credential-exfiltration channel.

The webhook endpoint requires no authentication (PR:N), which aligns with the inherent design of bot callbacks. The attack complexity is rated High (AC:H), reflecting that the attacker must craft a syntactically valid Bot Framework activity that the target accepts — a non-trivial but achievable construction for anyone familiar with the Bot Framework schema. The scope is changed (S:C), because the exfiltrated OAuth tokens grant access to resources outside the Budibase security authority — namely, the downstream Microsoft ecosystem the bot is authorized to act within.

The persistence behavior is the most operationally significant detail. Unlike a one-shot SSRF, this issue allows an attacker to establish a durable redirection of legitimate bot traffic to an attacker-controlled host. Every reply cycle re-transmits credentials until the poisoned serviceUrl is corrected, making exfiltration continuous rather than single-shot.

Exploitation Scenarios

No public PoC is available; the following chain is inferred strictly from the vulnerability class (SSRF / CWE-918) and the documented behaviors in the NVD description. No specific function names, parameters, or internal file paths beyond those stated (serviceUrl, the Microsoft Teams webhook endpoint, Bot Framework activities, Authorization headers) are asserted.

1. Reconnaissance / target identification. The attacker identifies an externally reachable Budibase instance running a version prior to 3.45.0 with the Microsoft Teams integration configured. Public fingerprinting (web title, static assets) can reveal self-hosted Budibase deployments exposed to the internet.

2. Triggering the flaw class. The attacker locates the Microsoft Teams webhook endpoint on the target and submits a crafted POST request. Because the endpoint is unauthenticated, no credentials are required. The request body is a forged Bot Framework activity whose serviceUrl field points to a host controlled by the attacker.

3. Payload / execution at the vulnerability-class level. The server does not validate the serviceUrl against an allowlist of legitimate Microsoft endpoints. It persists the attacker-supplied value. When the server later generates bot replies, it directs outbound HTTP requests to the attacker-controlled host and includes the live Microsoft OAuth access token in the Authorization header of those requests.

4. Post-exploitation impact. The attacker's listener captures the Authorization header, obtaining a live Microsoft OAuth access token. Possession of that token grants the attacker whatever privileges the bot integration holds in the connected Microsoft tenant. Separately, because the server will make outbound requests to the attacker-specified destination, the flaw also provides a blind SSRF primitive — useful for internal network probing and potentially for interacting with internal-only services reachable from the Budibase host.

The dual impact (credential exfiltration + blind internal access) is exactly what elevates this beyond a routine SSRF and justifies the Changed Scope metric on the CVSS vector.

Impact Assessment

• Confidentiality (Low, C:L): The primary impact — exfiltration of a live Microsoft OAuth access token. The CVSS metric is Low in the base score because the impact is bounded by the privileges and lifetime of the specific token issued to the bot integration, rather than exposing the entire Budibase datastore.
• Integrity (Low, I:L): The persisted serviceUrl value is modified; the attacker can influence where legitimate bot replies are delivered.
• Availability (None, A:N): No direct denial-of-service impact is described.
• Scope (Changed, S:C): The compromised OAuth token grants access to resources governed by Microsoft's identity/authorization boundary, outside the Budibase component itself.

Business impact: Organizations that have connected Budibase to Microsoft Teams gain the ability to read or act on Microsoft 365 resources within the bot's granted scope — which may include channel messages, user data, or other Graph resources depending on the permissions granted during integration setup. The persistence of the poisoned serviceUrl means the exfiltration channel remains open and silent until detected and remediated. Because the endpoint is unauthenticated, the attack surface is any internet-exposed Budibase instance with the Teams integration enabled — no user interaction and no credentials required.

Blast radius: The affected system is the Budibase server itself; the downstream blast radius extends into the connected Microsoft tenant, scoped to the bot's permissions. Blind SSRF additionally exposes the internal network segment reachable from the Budibase host.

Detection Guidance

Sigma Rule

title: Budibase Microsoft Teams Webhook SSRF and OAuth Token Exfiltration Attempt
id: 7e2f4b91-0a6c-4d3a-9b2e-cve2026100681
status: experimental
description: Detects forged Bot Framework activities submitted to the Budibase Microsoft Teams webhook endpoint with suspicious serviceUrl values, indicating SSRF and OAuth token exfiltration attempts against CVE-2026-100681.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100681
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.918
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/webhooks/'
      - '/teams'
      - '/bot'
  selection_method:
    cs-method: 'POST'
  selection_serviceurl:
    cs-uri-query|contains: 'serviceUrl'
    # Match a serviceUrl that is NOT a trusted Microsoft endpoint
    cs-uri-query|re: 'serviceUrl=(?!https://(smba\.tomicrosoft\.com|.*\.botframework\.com|.*\.trafficmanager\.net))'
  condition: selection_endpoint and selection_method and selection_serviceurl
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate bot activities from Microsoft infrastructure
level: high

YARA Rule

rule CVE_2026_100681_Budibase_Teams_SSRF
{
    meta:
        description = "Detects forged Bot Framework activities with attacker-controlled serviceUrl targeting Budibase Teams webhook (CVE-2026-100681)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100681"
        date = "2026-01-01"
        cwe = "CWE-918"
        severity = "high"

    strings:
        $bf1 = "\"serviceUrl\"" ascii nocase
        $bf2 = "\"channelId\"" ascii nocase
        $bf3 = "\"type\"" ascii nocase
        $act = "\"activity\"" ascii nocase
        $ms1 = "botframework.com" ascii nocase
        $ms2 = "smba.tomicrosoft.com" ascii nocase
        $tok = "Authorization" ascii nocase
        $bearer = "Bearer " ascii

    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x7B0A or true
        and (
            ($bf1 and $bf2 and ($bf3 or $act))
            and (not $ms1 and not $ms2)
        )
        or ($bf1 and $tok and $bearer)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100681 Budibase Teams Webhook SSRF - Forged serviceUrl to Non-Microsoft Host"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"webhook"; nocase; http.request_body; content:"serviceUrl"; nocase; pcre:"/serviceUrl\\"?\s*:\s*\\"?https?:\/\/(?!(smba\.tomicrosoft\.com|[a-z0-9.-]*botframework\.com|[a-z0-9.-]*trafficmanager\.net))/i"; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100681; classtype:web-application-attack; sid:2026100681; rev:1;)

alert http any any -> any any (msg:"CVE-2026-100681 Possible Budibase OAuth Token Exfiltration to Attacker Host"; flow:established,to_server; http.header; content:"Authorization"; nocase; http.header; content:"Bearer "; http.host; pcre:"/^(?!.*(microsoft|botframework|teams|graph\.microsoft)\.?)/i"; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100681; classtype:attempted-recon; sid:2026100682; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [ network where network.protocol == "http" and http.request.method == "POST"
      and http.request.body.text like~ "*serviceUrl*"
      and http.request.body.text not like~ "*botframework.com*"
      and http.request.body.text not like~ "*smba.tomicrosoft.com*" ]
  [ network where network.protocol == "http"
      and http.request.headers.text like~ "*Authorization*Bearer*"
      and not destination.domain like "*microsoft*" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=budibase
method=POST uri_path IN ("*webhook*", "*teams*", "*bot*")
| rex field=form_data "serviceUrl\\\"?\s*[:=]\s*\\\"?(?<svc_url>https?://[^\"&\s]+)"
| where isnotnull(svc_url) AND NOT match(svc_url, "(?i)(smba\.tomicrosoft\.com|botframework\.com|trafficmanager\.net)")
| stats count min(_time) AS first_seen max(_time) AS last_seen values(svc_url) AS targeted_urls by src_ip, uri_path, host
| eval risk="HIGH - Budibase Teams SSRF serviceUrl injection (CVE-2026-100681)"
| sort - count

Wazuh OSSEC Rule

<group name="web,budibase,cve-2026-100681,">
  <rule id="202600681" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <field name="method">POST</field>
    <field name="url" type="pcre2">(?i)/(webhook|teams|bot)</field>
    <field name="url" type="pcre2">(?i)serviceUrl=.*https?://(?!(smba\.tomicrosoft\.com|.*botframework\.com|.*trafficmanager\.net))</field>
    <description>Possible Budibase Teams webhook SSRF with attacker-controlled serviceUrl (CVE-2026-100681)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,cwe_918,</group>
  </rule>

  <rule id="202600682" level="13">
    <decoded_as>web-accesslog</decoded_as>
    <field name="request" type="pcre2">(?i)Authorization.*Bearer</field>
    <field name="dest_host" type="pcre2">(?i)^(?!.*(microsoft|botframework|teams))</field>
    <description>Possible OAuth token exfiltration to non-Microsoft host from Budibase (CVE-2026-100681)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>data_exfiltration,cwe_918,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in Budibase 3.45.0, but no vendor advisory, commit hash, or release reference has been confirmed by any tracked source. Treat all remediation as unverified until validated against an official Budibase release.

1) Immediate mitigations:

• Restrict network access to the Microsoft Teams webhook endpoint. If the Teams integration is not in active use, disable it entirely.
• Place the Budibase server behind a reverse proxy or WAF that enforces an allowlist on inbound serviceUrl values, permitting only trusted Microsoft Bot Framework domains (*.botframework.com, smba.tomicrosoft.com, and Microsoft traffic manager hosts).
• Implement egress filtering so the Budibase host can only initiate outbound requests to approved Microsoft endpoints, blocking blind SSRF to internal networks and attacker hosts.
• If the integration uses a static or rotatable bot credential, rotate Microsoft OAuth credentials and audit the Microsoft tenant for unusual activity by the bot identity.
• Do not expose Budibase instances directly to the internet unless absolutely required; require authentication at the perimeter.

2) Patch / upgrade steps:

• Upgrade to Budibase 3.45.0 or later, per the version fix noted in the NVD description. Verify the release notes and changelog against the official Budibase repository before deploying, since patch evidence is currently unconfirmed in tracked sources.
• After upgrade, re-validate the Microsoft Teams integration and confirm serviceUrl values are constrained to Microsoft domains.
• Rotate all Microsoft OAuth tokens and bot credentials associated with the integration following remediation, on the assumption that any prior exposure may have leaked them.

3) Long-term hardening:

• Enforce strict allowlisting of outbound request destinations for all webhook and integration features, not just the Teams endpoint.
• Treat serviceUrl and all externally supplied callback URLs as untrusted input; validate against known-good endpoints at ingestion time, not at use time.
• Ensure sensitive tokens such as OAuth access tokens are never attached to requests to destinations that are not on a hardcoded, verified allowlist.
• Add monitoring and alerting for outbound requests carrying Authorization headers to non-Microsoft hosts (see Detection Guidance).
• Adopt a routine dependency/integration review process to catch unauthenticated callback endpoints across the platform.

References

1. NVD — CVE-2026-100681: https://nvd.nist.gov/vuln/detail/CVE-2026-100681
2. Budibase official project / repository (verify 3.45.0 release and changelog): https://github.com/Budibase/budibase
3. CWE-918 — Server-Side Request Forgery: https://cwe.mitre.org/data/definitions/918.html
4. Microsoft Bot Framework — Activities and serviceUrl semantics: https://learn.microsoft.com/en-us/azure/bot-service/rest-api/bot-framework-rest-connector-api-reference
5. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Note: No public PoC, exploit code, or Nuclei template is available for CVE-2026-100681. The vulnerability is not listed in CISA KEV, and no threat actor campaigns or in-the-wild exploitation evidence have been observed in the data provided. No EPSS score has been assigned by FIRST.org at the time of writing.