The vulnerability exists in the uploadUrl() function in packages/server/src/utilities/fileUtils.ts, which uses a bare fetch(url) call without any SSRF protection. When the AI table generation feature processes attachment columns containing URLs, these URLs are fetched server-side without blacklist validation. A builder-level user can craft prompts that cause the AI to generate URLs pointing to internal IP addresses or cloud metadata endpoints. This leads to SSRF, allowing access to internal services and cloud metadata APIs. The correct approach, used elsewhere in Budibase, is to use fetchWithBlacklist() which validates URLs against a blacklist of private/internal IP ranges before fetching. Versions affected are up to and including 3.38.1.

An attacker with builder-level access can exploit this vulnerability to read sensitive cloud instance metadata such as AWS IAM credentials or GCP service account tokens. They can also enumerate internal services and exfiltrate data from private network resources. Additionally, the vulnerability enables bypassing network segmentation controls, such as those in DMZ or VPC deployments, and may facilitate internal port scanning via timing or error differences. This can lead to significant information disclosure and potential further compromise of the internal network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The suggested remediation is to replace the bare fetch() call in uploadUrl() with the fetchWithBlacklist() function, which performs validation against a blacklist of internal and private IP ranges before making requests. Until an official fix is released, restrict builder-level user access and disable the AI table generation feature if possible to reduce risk.