CVE-2026-45548

Description

Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation

Overview

State

—

Assigner (CNA)

—

CVSS severity

high

CVSS score

7.7 / 10

CVSS vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Effective score

7.7 / 10 HIGH source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2026-45548

Linked Threat

CVE-2026-45548 — CVE-2026-45548

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-32604

Assigner

GitHub_M

Published

May 27, 2026, 5:11:42 PM

Updated

May 27, 2026, 7:15:30 PM

EUVD base score (CVSS 3.1)

7.7 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EUVD-reported EPSS

0.2600

Vendors

budibase

Products

budibase (< 3.34.8)

Aliases

GHSA-rpj4-7x2v-wjrf

ENISA description: Budibase is an open-source low-code platform. Prior to 3.34.8, the processUrlFile function in packages/server/src/automations/steps/ai/extract.ts uses fetch(fileUrl) directly without the IP blacklist validation that is consistently applied to all other automation steps. This allows an authenticated user to trigger server-side requests to internal network addresses. This vulnerability is fixed in 3.34.8.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (5)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://github.com/Budibase/budibase/releases/tag/3.38.4 tenable:github.com
• https://github.com/Budibase/budibase/security/advisories/GHSA-rpj4-7x2v-wjrf tenable:github.com
• https://www.first.org/epss/ tenable:www.first.org
• https://nvd.nist.gov/vuln/detail/CVE-2026-45548 tenable:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2026-45548 tenable:www.cve.org

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• Microsoft Defender CVE-2026-41091 and CVE-2026-45498 Exploited
  web:blog.gridinsoft.com

  Microsoft has confirmed exploitation of two Microsoft Defender vulnerabilities fixed in the May 2026 security update cycle. CVE - 2026 -41091 is an elevation-of-privilege flaw in the Microsoft Malware Protection Engine, while CVE - 2026 -45498 is a denial-of-service flaw in the Microsoft Defender Antimalware Platform . The first bug matters more for incident response because a local authorized ...

  2026-05-26 02:56 UTC
• CISA Warns of Exploited Microsoft Defender 0-Day Flaws
  web:cyberpress.org

  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing an urgent remediation directive for federal agencies with a due date of June 3, 2026 .

  2026-05-26 02:56 UTC
• Security Update Guide - Loading - Microsoft
  web:msrc.microsoft.com

  Security Updates Acknowledgements

  2026-05-26 02:56 UTC
• Microsoft Defender Vulnerabilities Added to CISA KEV (CVE-2026-41091 ...
  web:op-c.net

  CISA has added two Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities catalog following evidence of active exploitation. The vulnerabilities, tracked as CVE - 2026 -41091 and CVE - 2026 -45498, affect core Microsoft Defender components used to protect Windows endpoints. CISA added both vulnerabilities to KEV on May 20, 2026 , with a federal remediation due date of June 3, 2026 .

  2026-05-26 02:56 UTC
• Microsoft Defender CVE-2026-41091 & CVE-2026-45498
  web:thecyberexpress.com

  Microsoft confirms active exploitation of CVE - 2026 -41091 and CVE - 2026 -45498 in Defender, with CVSS-rated risks, KEV listing, and urgent patches issued.

  2026-05-26 02:56 UTC
• Microsoft Warns of Two Actively Exploited Defender Vulnerabilities
  web:thehackernews.com

  Microsoft has disclosed that a privilege escalation and a denial-of-service flaw in Defender has come under active exploitation in the wild. The former, tracked as CVE - 2026 -41091, is rated 7.8 on the CVSS scoring system. Successful exploitation of the flaw could allow an attacker to gain SYSTEM privileges. "Improper link resolution before file access ('link following') in Microsoft Defender ...

  2026-05-26 02:56 UTC
• Microsoft Patches Two Actively Exploited Defender Zero-Days on Windows
  web:windowsreport.com

  Microsoft patched two actively exploited Defender zero-days affecting Windows systems and security components.

  2026-05-26 02:56 UTC
• Critical Microsoft Defender Vulnerabilities: How to Patch CVE-2026 ...
  web:www.archynewsy.com

  Understanding the Exploited Vulnerabilities The security risks involve two distinct CVE -tracked flaws that Microsoft has addressed in its latest updates: Critical Microsoft Defender Vulnerabilities Antimalware Platform CVE - 2026 -41091 (CVSS Score: 7.8): This vulnerability involves improper link resolution before file access, commonly known as "link following." By successfully exploiting ...

  2026-05-26 02:56 UTC
• Microsoft Defender vulnerabilities exploited in the wild (CVE-2026 ...
  web:www.helpnetsecurity.com

  Attackers are actively exploiting two Microsoft Defender vulnerabilities ( CVE - 2026 -41091 and CVE - 2026 -45498), Microsoft acknowledged.

  2026-05-26 02:56 UTC
• Microsoft confirms two major Defender security issues - TechRadar
  web:www.techradar.com

  Microsoft patches two actively exploited zero‑day flaws in Defender, tracked as CVE‑2026‑41091 (privilege escalation) and CVE‑2026‑45498 (denial of service) Updates were shipped ...

  2026-05-26 02:56 UTC

Only Available for Registered Users. Sign in to view.