CVE-2026-82243: Budibase Server before 3.41.3 SSRF with Credential Leakage
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to attacker-controlled servers, gaining full database access in cloud deployments.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs builder-level privileges in Budibase Server and network access to the datasource verify endpoint. The issue does not require user interaction.
Which deployments are most exposed?
Cloud deployments are specifically identified as at risk because leaked internal CouchDB credentials can provide full database access. Any affected server that permits builder-level users to submit attacker-controlled datasource URLs is exposed.
What is the remediation?
Upgrade Budibase Server to version 3.41.3 or later. The affected versions are those before 3.41.3.
How can we determine whether credentials may have been exposed?
Review datasource verification activity for builder-level users supplying arbitrary or attacker-controlled URLs, and investigate whether internal CouchDB credentials were sent to external servers. If such requests occurred, treat the CouchDB credentials as potentially compromised and assess database access.