CVE-2026-73407: Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152))
Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration.req in packages/server/src/integrations/rest.ts attached credentials from getAuthHeaders and defaultHeaders without requiring the final request destination to match the datasource origin. An unauthenticated caller of a PUBLIC POST /api/v2/queries/:queryId query could supply an absolute or parameterized path to an attacker-controlled host and receive the stored bearer, basic, or static-header credentials. This issue is fixed in version 3.40.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.40.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73407?
CVE-2026-73407 has a risk score of 71, indicating a high severity vulnerability.
How do I fix CVE-2026-73407?
To mitigate CVE-2026-73407, upgrade to Budibase version 3.40.1 or later, where the vulnerability has been addressed.
What does CVE-2026-73407 affect?
CVE-2026-73407 affects Budibase versions prior to 3.40.1 that misuse authentication headers in REST API calls.
What type of vulnerability is CVE-2026-73407?
CVE-2026-73407 is classified as a Path Traversal vulnerability associated with unauthenticated access to credentials.
Can CVE-2026-73407 be exploited remotely?
Yes, CVE-2026-73407 can be exploited by unauthenticated remote callers due to improper handling of authentication headers.