CVE-2026-82241: Server-Side Request Forgery (SSRF) in budibase server

Budibase backend-core, used by the Budibase server, omits the 100.64.0.0/10 shared address space range from its default SSRF blacklist used in REST datasource query previews. When the default blacklist is active (i.e., no custom BLACKLIST_IPS defined), an authenticated user with Builder permission can send a POST request to /api/queries/preview targeting an HTTP(S) service in the 100.64.0.0/10 range. This causes the server to perform a request to that target and return the response via the preview flow, effectively enabling SSRF. At the time of disclosure, no released fix was identified; remediation is to add the 100.64.0.0/10 range to the default blacklist.

An authenticated user with Builder permissions can exploit this SSRF vulnerability to make the Budibase server send HTTP(S) requests to internal services within the 100.64.0.0/10 shared address space. This could lead to unauthorized access to internal resources or information disclosure through the preview response. The vulnerability has a CVSS 4.0 score of 7.1 (high severity), indicating significant impact but requiring authentication and limited privileges.

No official patch or fix was available at the time of publication. The recommended mitigation is to add the 100.64.0.0/10 IP range to the DEFAULT_BLACKLIST used by the Budibase backend-core SSRF protection. Users should verify if a vendor advisory or update has been released since and apply any official fixes promptly.