CVE-2026-82246: Budibase Server before 3.41.3 SSRF via Query Import
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints and other restricted network resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibase Serverto a version that resolves this vulnerability.Fixed in 3.41.3 - Compensating control
Restrict network access from Budibase (especially the query import endpoint) to internal services and cloud metadata endpoints, so outbound requests to restricted network resources cannot be reached.
Event History
Frequently Asked Questions
Which deployments are affected?
Budibase Server versions before 3.41.3 are affected. The issue is in the query import endpoint.
What access does an attacker need?
An attacker needs low-level authenticated privileges to submit a URL through the query import endpoint. No user interaction is required.
What could an attacker reach through this issue?
The attacker can cause the server to fetch arbitrary user-supplied URLs and retrieve responses. This can expose internal services, cloud metadata endpoints, and other network resources that are restricted from direct attacker access.