CVE-2026-48146 affects Budibase, an open-source low-code platform, prior to version 3.39.0. The vulnerability exists in the OAuth2 token fetch function which uses raw fetch() without SSRF protection. While a safe wrapper fetchWithBlacklist() exists and is used elsewhere in the codebase, it was not applied to the OAuth2 token endpoint. Users with BUILDER role can exploit this to point OAuth2 token URLs to internal services like CouchDB or cloud metadata endpoints to exfiltrate sensitive data. The vulnerability has been fixed in version 3.39.0.