CVE-2026-100681: Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook
Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an attacker-controlled serviceUrl that is persisted and used for all subsequent bot replies, causing the server to send live Microsoft OAuth access tokens in Authorization headers to the attacker's host and enabling blind internal network access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.45.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Budibase deployments before 3.45.0 that expose the Microsoft Teams webhook endpoint are affected. The vulnerable endpoint can be reached without authentication.
What does an attacker need to exploit it?
An attacker needs only to send a crafted POST request containing a forged Bot Framework activity with an attacker-controlled serviceUrl. No credentials or user interaction are required, although exploitation has high attack complexity.
What is the impact after successful exploitation?
The attacker-controlled serviceUrl is persisted and used for subsequent bot replies. This can cause Budibase to send live Microsoft OAuth access tokens in Authorization headers to the attacker-controlled host and can provide blind access to internal network targets.
What should be done to remediate the issue?
Upgrade Budibase to version 3.45.0 or later. The issue affects versions before 3.45.0.