CVE-2026-82246: Server-Side Request Forgery (SSRF) in budibase server
Description
Budibase Server versions before 3.41.3 contain a server-side request forgery (SSRF) vulnerability in the query import endpoint. This flaw allows attackers to submit arbitrary URLs that the server fetches without proper validation, potentially exposing internal services such as cloud metadata endpoints and other restricted network resources. The vulnerability has a high severity rating with a CVSS 4.0 score of 7.1. No known exploits are reported in the wild. A fix is available in version 3.41.3.
CVSS v4.0
Score 7.1high
Affected software
budibase
server
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-82246 is a server-side request forgery vulnerability affecting Budibase Server prior to version 3.41.3. The vulnerability exists in the query import endpoint, which does not validate user-supplied URLs before fetching content. This allows an attacker with low privileges to cause the server to make arbitrary HTTP requests to internal or restricted network resources, including cloud metadata services. The CVSS 4.0 base score is 7.1, indicating high severity. The vulnerability was published on August 28, 2026, and no known active exploitation has been reported.
Potential Impact
An attacker can leverage this SSRF vulnerability to access internal network resources that are normally inaccessible externally. This may lead to information disclosure of sensitive internal services such as cloud metadata endpoints, which could facilitate further attacks or data leakage. The vulnerability requires no user interaction and low attack complexity but does require some level of privileges (PR:L).
Mitigation Recommendations
Upgrade Budibase Server to version 3.41.3 or later, where this SSRF vulnerability has been fixed. No other specific mitigations are indicated. Patch status is confirmed by the affectedVersions field indicating the fix in 3.41.3.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-28T10:37:51.949Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a916f91acd9273b49cf92c0
Added to database: 08/28/2026, 11:22:57 UTC
Last enriched: 10/09/2026, 21:23:20 UTC
Last updated: 10/12/2026, 18:58:02 UTC
Views: 51
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.