Budibase, an open‑source low‑code platform, contains an SSRF flaw in several automation step modules – outgoingWebhook, zapier, n8n, slack, and discord. The code uses node‑fetch to call user‑supplied URLs without enforcing the BLACKLIST_IPS rule that protects REST integrations, so authenticated users can trick the server into requesting any URL. This allows an attacker to reach cloud‑metadata endpoints, internal services, or other resources behind the application’s network, compromising confidentiality and potentially allowing credential leakage.

The vulnerability affects any installation running Budibase version 3.41.2 or earlier. The issue was fixed in release 3.41.3. Users deploying older versions should review the release notes for v3.41.3 to confirm the patch.

The CVSS score of 7.1 indicates high severity, and the vulnerability is technically exploitable by authenticated users who can grant themselves access to automation workflows. Because the internal services exposed by SSRF are reachable only from the application server, a successful attack would not automatically grant system‑wide privileges but could provide a foothold for lateral movement. No exploit is reported in CISA’s KEV catalog and EPSS data is unavailable, but the intrinsic nature of SSRF and the authentication requirement make it a realistic threat to any deployments that expose Budibase to untrusted users.