CVE-2026-100681
Received Received - Intake

Unauthenticated SSRF and Credential Exfiltration in Budibase

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an attacker-controlled serviceUrl that is persisted and used for all subsequent bot replies, causing the server to send live Microsoft OAuth access tokens in Authorization headers to the attacker's host and enabling blind internal network access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100681
EUVD
EUVD-2026-87654

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
budibase budibase to 3.45.0 (exc)
microsoft teams *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Budibase before version 3.45.0 has an unauthenticated server-side request forgery (SSRF) and OAuth token exfiltration vulnerability in its Microsoft Teams webhook endpoint. Attackers can send a crafted POST request to inject a malicious serviceUrl parameter. This causes the server to store and use the attacker-controlled URL for all subsequent bot replies, sending live Microsoft OAuth access tokens in Authorization headers to the attacker's host. This also enables blind internal network access.

Detection Guidance

Check Budibase logs for unusual POST requests to the Microsoft Teams webhook endpoint with arbitrary serviceUrl values. Monitor network traffic for outbound OAuth token transmissions to unexpected hosts. Review AI agent configurations for Microsoft Teams integrations in Budibase deployments.

Impact Analysis

This vulnerability allows attackers to steal live Microsoft OAuth access tokens, enabling them to impersonate bots, access Teams conversations, and exploit the Microsoft Graph API. It also provides blind internal network access for further probing. No authentication, user interaction, or privileges are required beyond knowing the webhook URL.

Mitigation Strategies

Upgrade Budibase to version 3.45.0 or later immediately. Disable Microsoft Teams AI agent integrations if not required. Implement network-level restrictions to block unauthorized outbound connections from Budibase servers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100681. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart