An administrator level privilege is enough to trigger the vulnerability through the REST datasource query preview endpoint. The endpoint accepts any URL directly, so an attacker directs the Budibase backend to issue requests to arbitrary addresses. This allows the server to contact internal network resources, such as cloud metadata services, databases, Kubernetes APIs, or other pods, bypassing external access restrictions.

Budibase, a low‑code platform for building internal tools, is affected. The flaw exists in all releases through version 3.30.6 and earlier. The specific component is the POST /api/queries/preview API, which improperly validates user supplied URLs.

The vulnerability receives a high severity score of 8.7, indicating a serious risk. The estimated likelihood of public exploitation is low, with a probability below one percent. It is not present in the national catalog of most actively exploited vulnerabilities. Successful exploitation requires administrative credentials; once authenticated, the attacker can use the open‑ended request to move laterally or compromise cloud resources.