AI Threat Alert
Budibase's chat-link handoff, which binds a Slack, Discord, Teams, or Telegram identity to a Budibase user so that platform can talk to the AI agent, runs on an unauthenticated public route with no CSRF token and leaks its own confirmation secret into the page HTML. An attacker mints a chat-link session for their own chat account, then tricks a logged-in victim into submitting a form-POST — a classic SameSite=Lax-compatible CSRF technique that requires no exotic tooling — which binds the victim's Budibase identity to the attacker's chat handle; the attacker then messages the AI agent from their own chat client, and every operation executes with the victim's permissions on agent actions, knowledge sources, and downstream automations. There's no public exploit, no Nuclei template, no CISA KEV listing, and no EPSS score yet, and the attack requires same-tenant access plus a successful phishing click, but the severity is high (CVSS 7.7) because a compromised admin account means full tenant takeover via chat. The fix is a targeted patch in Budibase 3.39.30 (commit 362e6c6, PR #19194); patch immediately and, until then, audit chat identity link bindings for accounts created without a matching legitimate confirmation click, or disable chat-based AI agent channels entirely.
What is the risk?
High risk for any self-hosted Budibase tenant with AI agent chat channels (Slack/Discord/Teams/Telegram) enabled. Exploitability is moderate: it requires the attacker to provision their own chat-link session (trivial, self-service) and to lure an authenticated victim into a single form submission (standard phishing, works because SameSite=Lax cookies allow top-level form-POST navigations). No authentication or privileges are needed against the victim's account directly — the CSRF rides on the victim's existing session. Impact is severe when the victim is a workspace admin, since the attacker inherits full agent-operation and automation permissions. The attack is same-tenant only, which caps blast radius versus a fully unauthenticated cross-tenant bug, but the lack of session-to-token binding on a sensitive identity-linking operation is a fundamental authentication-confusion flaw, not a hardening gap.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| @budibase/server | npm | <= 3.38.1 | No patch |
Do you use @budibase/server? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step-
1) Upgrade to Budibase 3.39.30 or later (fix commit 362e6c6, PR #19194) immediately on any instance with AI agent chat channels enabled. 2) Until patched, disable or restrict Slack/Discord/Teams/Telegram AI agent channel provisioning to reduce exposure. 3) Audit the chat identity link table for bindings that don't correspond to a deliberate, verified user action — flag any admin-level accounts linked to unfamiliar external chat identities and unlink them. 4) After patching, verify the fix binds the confirmation token to the requester's session at preparation time and that the POST route enforces CSRF protection (per the vendor's Fix section: session-bound tokens, CSRF synchroniser token, and route moved out of publicRoutes). 5) Monitor for anomalous AI agent activity attributable to accounts that don't match the acting chat identity's expected owner.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is GHSA-pvcr-8mvp-w8qr?
Budibase's chat-link handoff, which binds a Slack, Discord, Teams, or Telegram identity to a Budibase user so that platform can talk to the AI agent, runs on an unauthenticated public route with no CSRF token and leaks its own confirmation secret into the page HTML. An attacker mints a chat-link session for their own chat account, then tricks a logged-in victim into submitting a form-POST — a classic SameSite=Lax-compatible CSRF technique that requires no exotic tooling — which binds the victim's Budibase identity to the attacker's chat handle; the attacker then messages the AI agent from their own chat client, and every operation executes with the victim's permissions on agent actions, knowledge sources, and downstream automations. There's no public exploit, no Nuclei template, no CISA KEV listing, and no EPSS score yet, and the attack requires same-tenant access plus a successful phishing click, but the severity is high (CVSS 7.7) because a compromised admin account means full tenant takeover via chat. The fix is a targeted patch in Budibase 3.39.30 (commit 362e6c6, PR #19194); patch immediately and, until then, audit chat identity link bindings for accounts created without a matching legitimate confirmation click, or disable chat-based AI agent channels entirely.
Is GHSA-pvcr-8mvp-w8qr actively exploited?
No confirmed active exploitation of GHSA-pvcr-8mvp-w8qr has been reported, but organizations should still patch proactively.
How to fix GHSA-pvcr-8mvp-w8qr?
1) Upgrade to Budibase 3.39.30 or later (fix commit 362e6c6, PR #19194) immediately on any instance with AI agent chat channels enabled. 2) Until patched, disable or restrict Slack/Discord/Teams/Telegram AI agent channel provisioning to reduce exposure. 3) Audit the chat identity link table for bindings that don't correspond to a deliberate, verified user action — flag any admin-level accounts linked to unfamiliar external chat identities and unlink them. 4) After patching, verify the fix binds the confirmation token to the requester's session at preparation time and that the POST route enforces CSRF protection (per the vendor's Fix section: session-bound tokens, CSRF synchroniser token, and route moved out of publicRoutes). 5) Monitor for anomalous AI agent activity attributable to accounts that don't match the acting chat identity's expected owner.
What systems are affected by GHSA-pvcr-8mvp-w8qr?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent chat integrations, workflow automation pipelines.
What is the CVSS score for GHSA-pvcr-8mvp-w8qr?
GHSA-pvcr-8mvp-w8qr has a CVSS v3.1 base score of 7.7 (HIGH).
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0011.003 Malicious Link AML.T0053 AI Agent Tool Invocation AML.T0073 Impersonation Compliance Controls Affected
What are the technical details?
Original Advisory
### Summary The Budibase AI chat-link handoff flow (`GET/POST /api/chat-links/:instance/:token/handoff`) binds an **external chat identity** (Slack/Discord/MS Teams/Telegram) to a **Budibase user account**. The confirmation endpoint is on a **public route** (no CSRF middleware, no auth-group gate) and the only credential it checks is a `confirmationToken` that is **already rendered in plaintext into the HTML confirmation page** the victim views. There is no binding between the confirmation token and the requester's Budibase session at preparation time, and no CSRF token on the POST. Consequently, an attacker who creates a chat-link session for **their own** external chat identity (or any identity they can mint in their chat platform) can induce a victim Budibase user (same tenant) to submit the confirmation POST -> for example by sending them a link that auto-submits, or by XSS/CSRF on a co-tenanted page -> and the victim's `globalUserId` becomes bound to the attacker's external identity. The attacker then sends messages to the AI agent from their chat platform and is **acting as the victim user** inside Budibase automations/agent operations, inheriting the victim's permissions on agent operations, knowledge sources, and any downstream automation steps keyed off the linked identity. --- ### Affected | Component | Path | Lines | |---|---|---| | Public handoff routes (no auth-group middleware) | `packages/server/src/api/routes/chat.ts` | `23` (`GET /api/chat-links/:instance/:token/handoff`), `27` (`POST .../handoff`) | | Confirmation controller | `packages/server/src/api/controllers/ai/chatIdentityLinks.ts` | `124-177` (`confirmChatLinkSession`); the binding at `153-173` | | Confirmation token rendered into HTML | `packages/server/src/api/controllers/ai/chatIdentityLinks.ts` | `40-60` (`renderLinkConfirmationPage`); the hidden input at `55` | | Session creation (attacker side) | `packages/server/src/sdk/workspace/ai/chatIdentityLinks.ts` | `138-171` (`createChatIdentityLinkSession`), `173-188` (`prepareChatIdentityLinkSessionConfirmation`) | | Upsert of identity link | `packages/server/src/sdk/workspace/ai/chatIdentityLinks.ts` | `201-250` (`upsertChatIdentityLink`) | **Affected versions:** `master` at commit `3c8d1b4023`. **Reachable over HTTP by:** the GET and POST are on `publicRoutes` (no auth-group middleware). The POST requires `ctx.isAuthenticated` at runtime (`controllers/ai/chatIdentityLinks.ts:142`) -> so the victim must be logged into Budibase when the POST fires (achievable via standard CSRF if cookies are sent cross-origin, or via phishing that lures the victim to submit). --- ### Root cause **Issue 1 -> The handoff routes are public and unauthenticated at the middleware layer.** ```ts // packages/server/src/api/routes/chat.ts:23, 27 publicRoutes.get("/api/chat-links/:instance/:token/handoff", ai.handoffChatLinkSession) publicRoutes.post("/api/chat-links/:instance/:token/handoff", ai.confirmChatLinkSession) ``` `publicRoutes` has **no group middleware** (`endpointGroups/standard.ts:24-25` calls `endpointGroupList.group()` with no middleware and then `.lockMiddleware()`). The routes do not have a per-route `authorized(...)`. There is **no CSRF middleware** on these routes -> Budibase's CSRF synchroniser token is enforced only for state-changing verbs on authenticated routes that are not in `NO_CSRF_ENDPOINTS`; the public-routes path bypasses it. **Issue 2 -> The confirmation token is exposed to anyone who views the GET page.** ```ts // packages/server/src/api/controllers/ai/chatIdentityLinks.ts:40-60 const renderLinkConfirmationPage = (session, action) => { ... return `<!doctype html>... <form method="post" action="${helpers.escapeHtml(action)}"> <input type="hidden" name="confirmationToken" value="${helpers.escapeHtml(session.confirmationToken)}"> <button type="submit">Confirm</button> </form> ...` } ``` The `confirmationToken` (a `newid()` UUIDv4 generated by `prepareChatIdentityLinkSessionConfirmation`) is rendered into a hidden form input. Anyone who loads the GET page sees the token in the page source. **Issue 3 -> The POST binds the **currently-authenticated user** to the external identity based solely on the confirmation token.** ```ts // packages/server/src/api/controllers/ai/chatIdentityLinks.ts:124-177 export async function confirmChatLinkSession(ctx) { ... if (!ctx.isAuthenticated) { throw new HTTPError("Authentication is required to link chat identity", 401) } if (!session.confirmationToken || ctx.request.body?.confirmationToken !== session.confirmationToken) { throw new HTTPError("Link confirmation is invalid or has expired", 400) } const currentGlobalUserId = getCurrentGlobalUserId(ctx) // <- victim's ID const consumedSession = await sdk.ai.chatIdentityLinks.consumeChatIdentityLinkSession(token) ... await sdk.ai.chatIdentityLinks.upsertChatIdentityLink({ provider: consumedSession.provider, externalUserId: consumedSession.externalUserId, // <- attacker's chat identity externalUserName: consumedSession.externalUserName, ... globalUserId: currentGlobalUserId, // <- bound to victim linkedBy: currentGlobalUserId, }) ... } ``` There is **no binding between the session and the requester's Budibase identity at preparation time**. `prepareChatIdentityLinkSessionConfirmation` (`sdk/workspace/ai/chatIdentityLinks.ts:173-188`) stores the `confirmationToken` keyed by `token` with no user-id field. Whoever is authenticated when the POST fires (and supplies the correct `confirmationToken`) gets bound. **Issue 4 -> `assertSessionMatchesInstance` only checks workspace ID, not user.** ```ts // packages/server/src/api/controllers/ai/chatIdentityLinks.ts:17-27 const assertSessionMatchesInstance = ({ workspaceId, instance }) => { if (!workspaceId || workspaceId !== instance) { throw new HTTPError("Link token is not valid for this workspace", 400) } } ``` The check confirms the session belongs to the same workspace as the URL `instance` param -> useful for preventing cross-workspace confusion but useless against same-tenant identity confusion. --- ### Reproduction **Step-by-step attack** 1. **Attacker (tenant T) provisions a chat-link session for their own external identity.** Via the agent channel provisioning flow (e.g. `POST /api/agent/:agentId/slack/provision` or via the Discord/MS Teams/Telegram provisioning endpoints), the attacker obtains a chat-link `token` bound to **their own** Slack user ID. The session is stored in Redis keyed by `token`, scoped to tenant T. 2. **Attacker triggers `prepareChatIdentityLinkSessionConfirmation`.** Either by GETting the handoff page themselves (if they have a Budibase session) or via an internal API. The `confirmationToken` is generated and stored. 3. **Attacker crafts a phishing/auto-submit page** that POSTs to `/api/chat-links/<instance>/<token>/handoff` with the leaked `confirmationToken` in the body. Example: ```html <form id="f" method="post" action="https://victim.budibase.app/api/chat-links/app_xxx/linktoken/handoff"> <input name="confirmationToken" value="<leaked-token>"> </form> <script>document.getElementById('f').submit()</script> ``` 4. **Victim (a Budibase user in tenant T, e.g. an admin) is lured to the attacker page** while logged into Budibase. Their browser sends the POST cross-origin. If the Budibase auth cookie is sent on cross-site requests (`SameSite=Lax` by default allows top-level POST navigations, which a form-submit is), the request is authenticated as the victim. 5. **The victim's `globalUserId` is now bound to the attacker's Slack identity.** When the attacker DMs the AI agent from Slack, the agent's operations run as the victim user -> with the victim's permissions on agent operations, knowledge sources, file uploads, and any downstream automation steps keyed off the linked identity. **Mitigating factors:** - `SameSite=Lax` cookies block cross-site POSTs from sub-resources (fetch / XHR) but **allow** top-level form-POST navigations. A phishing page that submits the form via `document.form.submit()` (a top-level navigation) succeeds. So the CSRF works with the default cookie policy. - The attack is **same-tenant only** (`session.tenantId !== context.getTenantId()` is checked in the sdk). - The attacker must induce the victim to click a link (standard phishing). No silent drive-by. --- ### Impact | Capability | Available | |---|---| | Bind an attacker-controlled chat identity to a victim's Budibase account | ✅ | | Send messages to the AI agent as the victim user (Slack/Discord/MS Teams/Telegram) | ✅ | | Inherit the victim's permissions on agent operations | ✅ | | Trigger automations / agent operations that the victim is authorised for | ✅ | | Read knowledge sources the victim has access to | ✅ | The severity depends on what the agent can do as the victim. For an admin victim, this is full tenant administration via chat. For a regular user, it is impersonation within the agent subsystem. The bound identity persists until manually unlinked, so the attacker retains ongoing access. This is a same-tenant, user-interaction-required primitive. It is below the "unauthenticated RCE" threshold but above "hardening" -> it is a real authentication-confusion vulnerability on a sensitive identity-binding operation. --- ### Fix **Recommended layered fixes:** 1. **Bind the confirmation token to the requester's Budibase session at preparation time.** In `prepareChatIdentityLinkSessionConfirmation`, store the `globalUserId` of the requester alongside the `confirmationToken`. In `confirmChatLinkSession`, verify that `getCurrentGlobalUserId(ctx)` matches the stored requester. This breaks the CSRF / cross-user confusion. 2. **Add a CSRF token to the confirmation POST.** The standard Budibase CSRF synchroniser token (`x-csrf-token` header, validated against the session's `csrfToken`) should be enforced on `POST /api/chat-links/.../handoff`. Move the route out of `publicRoutes` to an authenticated route group so CSRF applies (the GET can remain public for the redirect-to-login flow; the POST should be authenticated + CSRF-protected). 3. **Add a per-session nonce that is bound to the requester's browser** (e.g. a signed cookie set on the GET, validated on the POST) to prevent cross-origin submission even when `SameSite=Lax` allows it. 4. **Require user re-authentication (re-entry of password / step-up auth)** for sensitive identity-binding operations, similar to how password change requires re-auth.
Exploitation Scenario
An attacker with a valid account in the same Budibase tenant as the target creates a chat-link session for their own Slack identity via the agent's Slack provisioning flow, then loads the GET handoff page to obtain the plaintext confirmationToken rendered in the HTML. They build a phishing page containing an auto-submitting HTML form that POSTs this token to the tenant's `/api/chat-links/:instance/:token/handoff` endpoint, and send the link to a Budibase admin at the same organization (e.g., via email or a co-tenanted XSS vector). When the admin, already logged into Budibase, opens the link, their browser silently submits the form as a top-level navigation, which bypasses SameSite=Lax cookie restrictions. The server binds the admin's globalUserId to the attacker's Slack identity. From that point, the attacker DMs the AI agent from their own Slack account and every agent operation — data retrieval from knowledge sources, automation triggers, tool invocations — executes with the admin's full permissions, giving the attacker persistent, chat-driven administrative control over the tenant.
Weaknesses (CWE)
CWE-285 Improper Authorization
Primary
CWE-345 Insufficient Verification of Data Authenticity
Primary
CWE-352 Cross-Site Request Forgery (CSRF)
Primary
CWE-285 — Improper Authorization: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
- [Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- [Architecture and Design] Ensure that you perform access control checks related to your business logic. These checks may be different than the access control checks that you apply to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N References
Timeline
Related Vulnerabilities
CVE-2023-3765 10.0 MLflow: path traversal allows arbitrary file read
Same attack type: Data Leakage CVE-2025-5120 10.0 smolagents: sandbox escape enables unauthenticated RCE
Same attack type: Data Leakage CVE-2025-53767 10.0 Azure OpenAI: SSRF EoP, no auth required (CVSS 10)
Same attack type: Auth Bypass CVE-2025-2828 10.0 LangChain RequestsToolkit: SSRF exposes cloud metadata
Same attack type: Auth Bypass CVE-2026-21858 10.0 n8n: Input Validation flaw enables exploitation
Same attack type: Auth Bypass