CVE-2026-103757

Executive Summary

CVE-2026-103757 is a server-side request forgery (SSRF) vulnerability in the Budibase low-code platform, present through version 3.41.0. An authenticated user with builder privileges can submit a crafted prompt to the AI table generation endpoint (POST /api/ai/tables) that causes the server to fetch an attacker-supplied internal URL, with the fetched response returned to the attacker via a presigned object-storage URL. Successful exploitation enables retrieval of sensitive internal resources such as cloud metadata credentials, with a CVSS base score of 7.7 reflecting high confidentiality impact and a scope change.

Technical Analysis

The vulnerability is classified as CWE-918 (Server-Side Request Forgery). According to the NVD description, the root cause is that the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of the platform's protected fetchWithBlacklist helper. The fetchWithBlacklist routine is evidently intended to validate and block requests to internal or otherwise disallowed address ranges before they are issued; by bypassing it, the uploadUrl path allows the server to fetch arbitrary URLs, including internal-only services.

The attack surface is the AI table generation feature exposed at POST /api/ai/tables. This endpoint accepts user-supplied prompts and uses them to generate table structures. An authenticated builder can craft a prompt that places an internal URL into an attachment column. When the server processes the generated table, it attempts to retrieve the referenced URL through uploadUrl, which performs the outbound fetch without the blacklist enforcement applied by fetchWithBlacklist.

Because the fetch is performed server-side, the attacker's request originates from the Budibase application host, placing it inside the trusted network perimeter. The server then stores or exposes the fetched content through a presigned object-storage URL that is returned to the requester. This response channel is what makes the SSRF both practical and exfiltration-capable: the attacker does not merely trigger an outbound request, but receives the response body, for example the contents of a cloud instance metadata endpoint containing credentials.

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N indicates network exploitability, low attack complexity, and low privileges required (the attacker must be an authenticated builder). No user interaction is required. The scope is changed (S:C), because the vulnerable component causes the server to act against resources beyond its intended authorization boundary. Confidentiality impact is high (C:H), while integrity and availability impacts are none (I:N/A:N). No public proof-of-concept, exploit code, or Nuclei template was identified at the time of writing; the exploitation model is inferred from the documented vulnerability class and the NVD description.

Exploitation Scenarios

The following chain is derived strictly from the NVD description. No public PoC is available; the sequence below is described at the vulnerability-class level and does not assume undocumented implementation details.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-exposed Budibase instance with the AI table generation feature enabled. Because exploitation requires builder privileges, the attacker either holds a legitimate builder account or has obtained one through prior credential compromise or invitation abuse. Version fingerprinting confirms the instance is running 3.41.0 or earlier.

2. Triggering the flaw. The authenticated builder sends a request to POST /api/ai/tables containing a prompt designed so that the AI-generated table definition includes an attachment column whose value is an internal URL (for example, a cloud metadata service address). The AI generation step produces a table schema incorporating that URL.

3. Server-side fetch. When the attachment URL is processed, the server invokes uploadUrl in packages/server/src/utilities/fileUtils.ts. Because this function uses raw node-fetch rather than fetchWithBlacklist, the internal URL is not rejected by the blacklist logic. The Budibase server consequently issues an HTTP request to the internal target from within its own network context.

4. Payload / response exfiltration. The server returns a presigned object-storage URL that contains or references the response body obtained from the internal fetch. The attacker retrieves this presigned URL and reads the internal resource content — for example, cloud instance metadata credentials — thereby completing the SSRF-to-exfiltration chain.

5. Post-exploitation impact. Leaked cloud metadata credentials or internal service responses can be used to pivot into the hosting environment: accessing cloud APIs, enumerating internal services, or moving laterally. No integrity or availability impact is expected from the SSRF itself; the primary gain is confidential data disclosure.

Impact Assessment

The primary impact is high-confidentiality disclosure (C:H) of resources reachable from the Budibase server, including cloud metadata credentials as explicitly noted in the NVD description. The scope change (S:C) reflects that the vulnerable component can affect resources beyond its security scope, specifically internal services and metadata endpoints that are not intended to be reachable by a builder-level user.

Attack complexity is low (AC:L) and no user interaction is required (UI:N). The only precondition is an authenticated account with builder privileges (PR:L). Blast radius depends on network placement: instances deployed in cloud environments with accessible metadata services are at the greatest risk, since metadata credentials frequently grant broad access to cloud accounts. Internally deployed instances may expose adjacent internal services. Because no patch is available and no vendor workaround has been published, exposure persists until upstream remediation is delivered or compensating controls are applied.

Detection Guidance

Sigma Rule

title: Budibase AI Table Generation SSRF Attempt via Attachment URL
id: 3f9a1c62-7b4e-4d21-9c8a-5e2f6a1d0b74
status: experimental
description: Detects requests to the Budibase AI table generation endpoint containing internal or metadata URLs in attachment fields, indicating CVE-2026-103757 exploitation attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103757
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026-103757
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-method: 'POST'
    cs-uri-stem|endswith: '/api/ai/tables'
  selection_internal_url:
    - cs-uri-query|contains:
        - '169.254.169.254'
        - 'metadata.google.internal'
        - 'metadata.azure'
        - '127.0.0.1'
        - 'localhost'
        - 'file://'
  condition: selection_endpoint and selection_internal_url
falsepositives:
  - Legitimate AI prompts that reference localhost or internal resources without malicious intent
level: high

YARA Rule

rule CVE_2026_103757_Budibase_SSRF_Attachment
{
    meta:
        description = "Detects Budibase AI table generation requests abusing attachment URLs for SSRF (CVE-2026-103757)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103757"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ep = "/api/ai/tables"
        $m1 = "169.254.169.254" nocase
        $m2 = "metadata.google.internal" nocase
        $m3 = "attachment" nocase
        $m4 = "http://127.0.0.1" nocase
        $m5 = "http://localhost" nocase

    condition:
        $ep and (any of ($m*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103757 Budibase AI Table SSRF via Attachment URL"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/ai/tables"; http.request_body; content:"attachment"; http.request_body; pcre:"/(169\.254\.169\.254|metadata\.google\.internal|127\.0\.0\.1|localhost)/i"; reference:cve,2026-103757; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-103757; classtype:web-application-attack; sid:2026103757; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [http where http.request.method == "POST" and endsWith(http.request.path, "/api/ai/tables")]
  [http where http.request.body.text contains "169.254.169.254" or
            http.request.body.text contains "metadata.google.internal" or
            http.request.body.text contains "127.0.0.1" or
            http.request.body.text contains "localhost"]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=budibase
| search method=POST uri_path="/api/ai/tables"
| rex field=body "(?i)(?<ssrf_target>169\.254\.169\.254|metadata\.google\.internal|127\.0\.0\.1|localhost|file://)"
| where isnotnull(ssrf_target)
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, ssrf_target, uri_path
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="web,budibase,cve-2026-103757">
  <rule id="103757" level="12">
    <decoded_as>json</decoded_as>
    <field name="http_method">^POST$</field>
    <url>/api/ai/tables</url>
    <regex field="request_body">169\.254\.169\.254|metadata\.google\.internal|127\.0\.0\.1|localhost</regex>
    <description>CVE-2026-103757: Budibase SSRF attempt via AI table attachment URL</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_103757,pci_dss_6.5,gdpr_IV_35.7.d,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is currently documented.

1. Immediate mitigations.

   • Restrict builder account provisioning and audit existing builder accounts for least privilege; exploitation requires authenticated builder access.
   • If the AI table generation feature is not required, disable or block access to the POST /api/ai/tables endpoint at a reverse proxy or WAF.
   • Enforce egress filtering on the Budibase host so that requests to link-local metadata addresses (for example 169.254.169.254) and internal service ranges are denied.
   • Where supported by the cloud platform, require IMDSv2 (session-oriented metadata access) and disable legacy metadata endpoints to reduce the value of metadata retrieval.
   • Network-segment the Budibase application so that it cannot reach sensitive internal services.

2. Patch/upgrade steps.

   • Monitor the official Budibase project for a release that replaces the raw node-fetch call in packages/server/src/utilities/fileUtils.ts with the fetchWithBlacklist helper or an equivalent address-validation routine.
   • Because no fix is currently available, no version upgrade path can be recommended at this time. Track vendor advisories and apply the patched release immediately upon availability.

3. Long-term hardening.

   • Ensure all server-side fetch routines pass through a centralized allowlist/blacklist validator and centralize URL fetching logic to eliminate ad-hoc calls.
   • Deploy outbound egress controls (deny-by-default) for application workloads to prevent SSRF from reaching internal or metadata endpoints.
   • Apply least privilege to cloud instance roles so that exposure of metadata credentials carries minimal blast radius.
   • Add logging and alerting on internal-address fetches originating from application servers.
   • Validate and sanitize AI-generated table schemas, particularly user-controlled fields such as attachment URLs, before the server acts on them.

References

• NVD — CVE-2026-103757: https://nvd.nist.gov/vuln/detail/CVE-2026-103757
• CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Budibase project repository and release notes (monitor for patch addressing packages/server/src/utilities/fileUtils.ts): https://github.com/Budibase/budibase
• OWASP — Server-Side Request Forgery Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html

No threat actor campaigns or exploit-in-the-wild evidence were identified for CVE-2026-103757 at the time of writing. The CVE is not listed in the CISA KEV catalog, and no public proof-of-concept or Nuclei template was observed.