CVE-2026-33226

Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview

Published Mar 20, 2026 CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Description

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions from 3.30.6 and prior, the REST datasource query preview endpoint (POST /api/queries/preview) makes server-side HTTP requests to any URL supplied by the user in fields.path with no validation. An authenticated admin can reach internal services that are not exposed to the internet — including cloud metadata endpoints (AWS/GCP/Azure), internal databases, Kubernetes APIs, and other pods on the internal network. On GCP this leads to OAuth2 token theft with cloud-platform scope (full GCP access). On any deployment it enables full internal network enumeration. At time of publication, there are no publicly available patches.

Analysis

Technical impact

An administrator level privilege is enough to trigger the vulnerability through the REST datasource query preview endpoint. The endpoint accepts any URL directly, so an attacker directs the Budibase backend to issue requests to arbitrary addresses. This allows the server to contact internal network resources, such as cloud metadata services, databases, Kubernetes APIs, or other pods, bypassing external access restrictions.

Affected Systems

Budibase, a low‑code platform for building internal tools, is affected. The flaw exists in all releases through version 3.30.6 and earlier. The specific component is the POST /api/queries/preview API, which improperly validates user supplied URLs.

Risk and Exploitability

The vulnerability receives a high severity score of 8.7, indicating a serious risk. The estimated likelihood of public exploitation is low, with a probability below one percent. It is not present in the national catalog of most actively exploited vulnerabilities. Successful exploitation requires administrative credentials; once authenticated, the attacker can use the open‑ended request to move laterally or compromise cloud resources.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Budibase

budibase

affected

Version	Status	Constraints
`<= 3.30.6`	affected	—

Configuration 1 [-]

cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Budibase

Version	Status	Scheme	Platform
`[0,3.30.6]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Restrict administrative access to the REST datasource query preview endpoint to trusted users only
Configure Budibase to allow outbound HTTP requests only to approved domains or IP ranges
Separate the Budibase deployment from sensitive internal services such as metadata endpoints and internal databases
Monitor Budibase logs for unusual outbound requests to internal resources and investigate promptly
Check the vendor’s website regularly for an update that addresses the SSRF issue

Generated by OpenCVE AI on March 23, 2026 at 21:06 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-4647-wpjq-hh7f	Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.381% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/Budibase/budibase/security/advisories/GHSA-4647-wpjq-hh7f

History

Mar 23, 2026 7:15 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:budibase:budibase::::::::

Mar 23, 2026 5:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mar 23, 2026 10:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Budibase Budibase budibase
Vendors & Products		Budibase Budibase budibase

Mar 21, 2026 5:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions from 3.30.6 and prior, the REST datasource query preview endpoint (POST /api/queries/preview) makes server-side HTTP requests to any URL supplied by the user in fields.path with no validation. An authenticated admin can reach internal services that are not exposed to the internet — including cloud metadata endpoints (AWS/GCP/Azure), internal databases, Kubernetes APIs, and other pods on the internal network. On GCP this leads to OAuth2 token theft with cloud-platform scope (full GCP access). On any deployment it enables full internal network enumeration. At time of publication, there are no publicly available patches.
Title		Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview
Weaknesses		CWE-918
References		https://github.com/Budibase/budibase/security/advisories/GHSA-4647-wpjq-hh7f
Metrics		cvssV3_1 `{'score': 8.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N'}`