What’s Vulnerable › Vulnerabilities

CVE-2026-100681: Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-26 · updated 2026-10-08
• Weakness: CWE-918

Description

Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an attacker-controlled serviceUrl that is persisted and used for all subsequent bot replies, causing the server to send live Microsoft OAuth access tokens in Authorization headers to the attacker's host and enabling blind internal network access.

Affected products

• budibase server: before 3.45.0 — fixed in 3.45.0

How to fix

Upgrade to a fixed version: budibase server 3.45.0. Check the vendor advisory for mitigations.

References

• https://github.com/Budibase/budibase/security/advisories/GHSA-942w-fccr-8r3c
• https://www.vulncheck.com/advisories/budibase-before-3.45.0-ssrf-and-oauth-token-exfiltration-via-teams-webhook
• https://github.com/Budibase/budibase/security/advisories/GHSA-942w-fccr-8r3c

Get alerted when CVE-2026-100681 or the next vulnerability affects your stack