CVE-2026-82241

Budibase's @budibase/backend-core library (shipped with @budibase/server) omits the shared address space range 100.64.0.0/10 from the DEFAULT_BLACKLIST it applies to REST datasource query previews, allowing requests into that range (CWE-918, SSRF). On a self-hosted deployment where the BLACKLIST_IPS variable has not been defined, an authenticated user holding the Builder permission can send a crafted POST /api/queries/preview request naming a reachable HTTP(S) service at a 100.64.0.0/10 address, causing the Budibase server to connect to that target. The response from the targeted service is returned through the preview flow, so the attacker can read content from internal services in that range (high confidentiality, low integrity impact; CVSS 4.0 score 7.1). Affected users are operators of self-hosted Budibase instances relying on the default blacklist; the advisory identifies no affected version range and no released fix at the time of publication. No exploitation is currently known: EPSS assigns a 0.2% 30-day exploitation probability (7th percentile), there is no public PoC, and the issue is not in CISA KEV.

What to do: No patched release was identified at publication, so treat current versions as vulnerable until Budibase ships a fix that adds 100.64.0.0/10 to DEFAULT_BLACKLIST. As an interim mitigation, define the BLACKLIST_IPS variable so the effective blacklist includes the standard private ranges plus 100.64.0.0/10, and review which users hold the Builder permission and which services at 100.64.0.0/10 addresses are reachable from the Budibase server. Monitor POST /api/queries/preview traffic for destinations in 100.64.0.0/10 and watch Budibase's release channels for an updated backend-core/server version.