CVE-2026-73407
CriticalCVSS 9.0Summary
Budibase prior to 3.40.1 did not verify that the final request destination matches the datasource origin, allowing an unauthenticated caller of a public query endpoint to supply an attacker-controlled host and receive stored credentials. This issue is fixed in version 3.40.1.
Risk Assessment
An attacker could obtain sensitive credentials used for external integrations, potentially leading to unauthorized access to data and systems.
Recommendation
Upgrade Budibase to version 3.40.1 or later immediately and review logs for suspicious queries to public endpoints.
Original NVD description (English source)
Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration._req in packages/server/src/integrations/rest.ts attached credentials from getAuthHeaders and defaultHeaders without requiring the final request destination to match the datasource origin. An unauthenticated caller of a PUBLIC POST /api/v2/queries/:queryId query could supply an absolute or parameterized path to an attacker-controlled host and receive the stored bearer, basic, or static-header credentials. This issue is fixed in version 3.40.1.