An unauthenticated attacker can issue a POST request to the publicly accessible /api/v2/queries/:queryId endpoint and supply an arbitrary absolute or parameterized URL that points to an attacker‑controlled host. The RestIntegration._req logic in Budibase prior to version 3.40.1 attaches stored bearer, basic, or static‑header credentials to the request without validating that the request destination matches the datasource origin. Consequently, the attacker receives the credentials that the application internally stores for accessing external services, which can be reused for further compromise of those services or other systems. Because the vulnerability permits unauthenticated credential disclosure, the potential impact spans confidentiality loss and a pivot to other targets.

Budibase low‑code platform servers running any version older than 3.40.1 are vulnerable. The issue resides in the server side REST integration module (packages/server/src/integrations/rest.ts). The affected vendor is Budibase and the product is the Budibase application; no partial patching is available for older minor releases.

The CVSS score of 9 indicates a critical severity. EPSS is not available, so the current exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV and the only documented attack vector requires no authentication, making it widely exploitable by any party who can reach the endpoint. The exploitation path involves sending a crafted POST request, which is simple for a remote attacker over HTTP/HTTPS. Given the critical score and lack of mitigations at the application level, the risk to exposed instances is high.