CVE-2026-82241: Budibase backend-core SSRF via incomplete default blacklist
Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist (DEFAULTBLACKLIST) used by REST datasource query previews. When the default blacklist is active (i.e., a self-hosted deployment has not defined BLACKLISTIPS), an authenticated user with the Builder permission can submit a REST datasource query preview request to POST /api/queries/preview targeting a reachable HTTP(S) service in the 100.64.0.0/10 range, causing the server to send a request to that target and return its response through the preview flow. Per the advisory, no released fix was identified at the time of publication; remediation is to add 100.64.0.0/10 to DEFAULTBLACKLIST.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
When using the default blacklist (i.e., BLACKLIST_IPS is not defined in a self-hosted deployment), add the shared address space range 100.64.0.0/10 to Budibase backend-core's DEFAULT_BLACKLIST used for SSRF protection in REST datasource query previews.
Budibase backend-core (@budibase/backend-core) DEFAULT_BLACKLIST = add 100.64.0.0/10
Event History
Frequently Asked Questions
Which deployments are exposed by the incomplete blacklist?
Self-hosted deployments that have not defined BLACKLIST_IPS use the default blacklist and are affected. The issue specifically concerns targets in the 100.64.0.0/10 shared address space range that are reachable from the Budibase server.
What access does an attacker need to exploit this?
An attacker needs an authenticated Budibase account with the Builder permission. They can submit a REST datasource query preview request to POST /api/queries/preview with an HTTP(S) target in the omitted address range.
What can be done if no released fix is available?
Add 100.64.0.0/10 to DEFAULT_BLACKLIST, as specified by the advisory. This prevents the default SSRF filtering configuration from allowing requests to that shared address space range.
How could exploitation affect an environment?
The Budibase server can send an HTTP(S) request to a reachable service in 100.64.0.0/10, and the target's response is returned through the query preview flow. This can expose responses from services accessible to the server but not necessarily to the Builder user directly.