CVE-2026-100681 budibase CVE debrief

Who should care

Security teams, Budibase administrators, and teams using Budibase servers with Microsoft Teams webhook integrations should assess exposure and prioritize patching to prevent potential exploitation.

Why it matters

Defenders should care about CVE-2026-100681 because it allows attackers to gain unauthorized access to Budibase servers and exfiltrate sensitive OAuth tokens, potentially leading to further exploitation and compromise of internal networks.

• Potential blind internal network access for attackers
• Exfiltration of live Microsoft OAuth access tokens
• Compromised bot replies and potential for further exploitation

Technical summary

The Budibase server-side request forgery and OAuth token exfiltration vulnerability exists in the Microsoft Teams webhook endpoint. Attackers can submit a crafted POST request with an arbitrary serviceUrl value, causing the server to send live Microsoft OAuth access tokens to the attacker's host. This vulnerability allows attackers to gain unauthorized access to Budibase servers and exfiltrate sensitive OAuth tokens, potentially leading to further exploitation and compromise of internal networks. Budibase server versions before 3.45.0 are affected, and defenders should prioritize verifying exposure of Budibase servers, especially those with Microsoft Teams webhook integrations, and ensure they are running 3.45.

Defensive priority

Defenders should prioritize verifying exposure of Budibase servers, especially those with Microsoft Teams webhook integrations, and ensure they are running version 3.45.0 or later. This requires immediate attention from security teams and Budibase administrators to prevent potential exploitation.

Recommended defensive actions

• Verify Budibase server versions and ensure they are running 3.45.0 or later
• Review Microsoft Teams webhook integrations for potential exposure
• Monitor for suspicious activity related to Budibase servers and Microsoft OAuth access tokens
• Confirm whether affected Budibase deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor advisories. However, there is limited information on potential exploitation or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.