SSRF Vulnerability in Budibase Backend-Core from Budibase
CVE-2026-82241

7.1HIGH

Key Information:

Vendor

Budibase

Status
Server
Vendor
CVE Published:
28 August 2026

What is CVE-2026-82241?

The Budibase backend-core component, utilized within the Budibase server, contains a Server-Side Request Forgery (SSRF) vulnerability due to the omission of the address space range 100.64.0.0/10 from its default blacklist. When the system's default blacklist is not defined, an authenticated user possessing Builder permissions can exploit this weakness by submitting a REST datasource query preview that directs a request to a reachable service in the vulnerable IP range. This enables malicious actions by accessing internal systems or sensitive data through the API's preview flow. As of the latest information, no official fix has been released, and it is recommended to manually add the range 100.64.0.0/10 to the DEFAULT_BLACKLIST for mitigation.

Affected Version(s)

server 0 < 3.41.3

server 3.41.3

References

https://github.com/Budibase/budibase/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/budibase-backend-cor...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

sec-reex
.