CVE-2026-82243

Budibase Server before 3.41.3 contains a server-side request forgery flaw (CWE-918) in its datasource verify endpoint, which accepts user-supplied URLs without applying SSRF validation. A builder-level (privileged) user can point the endpoint at an arbitrary URL, including attacker-controlled servers or internal services. By directing requests to a server they control, the attacker can capture outbound connections and leak internal CouchDB credentials, gaining full database access — an impact that is especially significant in cloud deployments. All Budibase Server deployments prior to 3.41.3 are affected, though exploitation requires an authenticated builder-level account, which limits exposure to environments where such users exist. There is currently no known public proof-of-concept, the flaw is not listed in CISA KEV, and EPSS assigns roughly a 0.2% probability of exploitation within 30 days.

What to do: Upgrade Budibase Server to version 3.41.3 or later, which adds SSRF validation to the datasource verify endpoint. Until patched, restrict builder-level access to trusted users and consider limiting the server's outbound network access (egress filtering) so it cannot reach attacker-controlled hosts. In cloud deployments, check whether CouchDB credentials could have been exposed via outbound requests and rotate them as a precaution.