Server-Side Request Forgery in Budibase Open-Source Platform
CVE-2026-35219

7.1HIGH

Key Information:

Vendor

Budibase

Status
Budibase
Vendor
CVE Published:
17 August 2026

What is CVE-2026-35219?

Budibase, an innovative open-source low-code platform, has a vulnerability affecting its automation features prior to version 3.41.3. This security issue arises from the use of node-fetch on user-provided URLs in various automation scripts. The lack of enforcement for BLACKLIST_IPS in these scripts enables authenticated users to perform unauthorized server-side requests, potentially accessing sensitive cloud metadata and internal services. This vulnerability was addressed in version 3.41.3, ensuring improved security for users.

Affected Version(s)

budibase < 3.41.3

References

https://github.com/Budibase/budibase/security/advisories/...
x_refsource_CONFIRM
https://github.com/Budibase/budibase/pull/19328
x_refsource_MISC
https://github.com/Budibase/budibase/commit/cc07563a6b0fc...
x_refsource_MISC

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.