CVE-2026-82246

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability (CWE-918) in its query import endpoint, which fetches content from user-supplied URLs without validating them. An authenticated user (the CVSS 4.0 vector requires low privileges) can submit an arbitrary URL, such as a cloud instance metadata address or an internal-only host, and the server will retrieve it and return the response. This allows the attacker to read responses from internal services and restricted network resources, with a high confidentiality impact that could include sensitive cloud metadata credentials, while integrity impact is low and availability is unaffected. Any Budibase Server deployment running a version prior to 3.41.3 is affected, particularly self-hosted or cloud-hosted instances where metadata endpoints and internal services are reachable from the server. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS assigns only a 0.2% probability of exploitation within 30 days, so exploitation is not currently known.

What to do: Upgrade Budibase Server to 3.41.3 or later, which adds validation of user-supplied URLs in the query import endpoint. Until patched, restrict the endpoint to trusted authenticated users and limit server egress to sensitive internal resources, especially the cloud metadata service (e.g., 169.254.169.254), and review logs for unexpected outbound requests from the server.