CVE-2026-82241
Received Received - Intake

SSRF Bypass in Budibase Backend-Core

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description
Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist (DEFAULT_BLACKLIST) used by REST datasource query previews. When the default blacklist is active (i.e., a self-hosted deployment has not defined BLACKLIST_IPS), an authenticated user with the Builder permission can submit a REST datasource query preview request to POST /api/queries/preview targeting a reachable HTTP(S) service in the 100.64.0.0/10 range, causing the server to send a request to that target and return its response through the preview flow. Per the advisory, no released fix was identified at the time of publication; remediation is to add 100.64.0.0/10 to DEFAULT_BLACKLIST.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-28
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-82241
EUVD
EUVD-2026-67693

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
budibase backend-core *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Budibase backend-core omitting the shared address space range 100.64.0.0/10 from its default SSRF blacklist. An authenticated user with Builder permission can exploit this to send requests to internal services in that IP range via REST datasource query previews.

Detection Guidance

Check if your Budibase deployment uses the default SSRF blacklist by inspecting the DEFAULT_BLACKLIST configuration. Look for the absence of 100.64.0.0/10 in the blacklist. Test by attempting a REST datasource query preview to a target in 100.64.0.0/10 and verify if the server processes the request.

Impact Analysis

An attacker could access internal services within the 100.64.0.0/10 range, potentially stealing sensitive data or interacting with internal systems. This could lead to unauthorized information disclosure or further network compromise.

Compliance Impact

This vulnerability could violate compliance requirements by exposing sensitive data to unauthorized parties, potentially breaching GDPR or HIPAA if personal or health information is accessed.

Mitigation Strategies

Add 100.64.0.0/10 to the DEFAULT_BLACKLIST in your Budibase configuration. If using a self-hosted deployment, ensure BLACKLIST_IPS is defined and includes this range. Restart the Budibase service after making changes to apply the updated blacklist.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82241. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart