Description
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints and other restricted network resources.
Published: 2026-08-28
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Server‑Side Request Forgery
Action: Immediate Patch
AI Analysis

Impact

The vulnerability allows an attacker to supply an arbitrary URL in the query import endpoint, causing the server to fetch and return data from that location without validation. This can expose internal network services, including cloud metadata endpoints, to unauthenticated access and confidentiality or integrity compromise.

Affected Systems

Budibase Server versions prior to 3.41.3 are affected. The query import endpoint does not verify user-supplied URLs, permitting SSRF against internal and restricted resources.

Risk and Exploitability

The CVSS score is 7.1, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw via the exposed endpoint, potentially retrieving data from internal services, and therefore the risk is significant unless mitigated.

Generated by OpenCVE AI on August 28, 2026 at 13:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Budibase Server patch by upgrading to version 3.41.3 or later.
  • If upgrading is not immediately possible, block or restrict the query import endpoint to reject external or untrusted URLs, allowing only a whitelist of approved destinations.
  • Configure network firewalls or internal routing so that the Budibase Server cannot reach sensitive internal services, limiting the scope of potential SSRF exploitation.
  • Monitor logs for anomalous query import activity and investigate any suspicious external URL requests.

Generated by OpenCVE AI on August 28, 2026 at 13:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Budibase server
Vendors & Products Budibase server

Fri, 28 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 28 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Description Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints and other restricted network resources.
Title Budibase Server before 3.41.3 SSRF via Query Import
First Time appeared Budibase
Budibase budibase
Weaknesses CWE-918
CPEs cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*
Vendors & Products Budibase
Budibase budibase
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Budibase Budibase Server
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-28T14:45:27.847Z

Reserved: 2026-08-28T10:37:51.949Z

Link: CVE-2026-82246

cve-icon Vulnrichment

Updated: 2026-08-28T14:45:23.452Z

cve-icon NVD

Status : Deferred

Published: 2026-08-28T12:16:36.360

Modified: 2026-08-28T18:54:09.323

Link: CVE-2026-82246

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T18:30:08Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)