Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step
Date: 2026-06
Affected: npm/budibase
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-48128
CWE: CWE-918

### Summary The executeQuery automation step in Budibase accepts a queryId from automation step inputs and passes it directly to the query execution controller without additional validation. When combined with a REST datasource configured to target internal infrastructure, this creates a server-side request forgery path where automation execution causes the Budibase server to make outbound HTTP requests to attacker-influenced destinations. The automation output then returns the response, potentially exposing internal service data. ### Details Inside the execute query automation step, the queryId value and any additional query parameters from `inputs.query` are assembled into a request context and forwarded to `queryController.executeV2AsAutomation`. The constructed context looks like the following: ```typescript const ctx: any = buildCtx(appId, emitter, { body: { parameters: rest, }, params: { queryId, }, user: context.user, }) ``` No validation is performed to confirm that the referenced query is appropriate for automation use, that the associated datasource targets an allowlisted destination, or that the supplied parameters do not override security-sensitive fields. The `context.user` value is also forwarded directly from automation context into the request, which may allow caller identity to be influenced by automation binding inputs. To reach exploitation, an attacker needs builder-level access to the Budibase application. With that access, they ca


Mitigations:

Architectural layers (MAESTRO):