CVE-2026-35219

Received Received - Intake

Authentication Bypass in Budibase via SSRF

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description

Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and packages/server/src/automations/steps/discord.ts use node-fetch on user-provided URLs without the BLACKLIST_IPS enforcement used by the REST integration, allowing an authenticated user to make server-side requests to cloud metadata and internal services. This issue is fixed in version 3.41.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-35219

Affected Vendors & Products

Vendor	Product	Version / Range
budibase	budibase	to 3.41.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability involves automation steps in Budibase versions before 3.41.3 that use node-fetch to make server-side requests to user-provided URLs without proper IP blacklisting. This allows authenticated users to access cloud metadata and internal services.

Detection Guidance

Check Budibase server logs for outgoing webhook, Zapier, n8n, Slack, or Discord automation steps making requests to unexpected internal or cloud metadata URLs. Inspect network traffic for outbound connections from Budibase to unauthorized endpoints.

Impact Analysis

An attacker with access could exploit this to make unauthorized requests to internal services or cloud metadata, potentially leading to data leaks, service disruption, or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements for protected health information.

Mitigation Strategies

Upgrade Budibase to version 3.41.3 or later to apply the fix. Review and restrict user permissions to prevent unauthorized automation step execution. Monitor network traffic for suspicious outbound requests from Budibase.

Hi! I’m here to help you understand CVE-2026-35219. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70