CVE-2026-33226: Budibase Low-Code Platform SSRF Flaw

CVE-2026-33226 Overview

CVE-2026-33226 is a Server-Side Request Forgery (SSRF) vulnerability affecting Budibase, a low code platform for creating internal tools, workflows, and admin panels. The REST datasource query preview endpoint (POST /api/queries/preview) makes server-side HTTP requests to any URL supplied by the user in fields.path with no validation, allowing authenticated administrators to reach internal services that are not exposed to the internet.

Critical Impact

An authenticated admin can access cloud metadata endpoints (AWS/GCP/Azure), internal databases, Kubernetes APIs, and other pods on the internal network. On GCP deployments, this leads to OAuth2 token theft with cloud-platform scope, granting full GCP access.

Affected Products

• Budibase versions from 3.30.6 and prior
• All Budibase deployments on cloud infrastructure (AWS, GCP, Azure)
• Self-hosted Budibase instances with access to internal networks

Discovery Timeline

• 2026-03-20 - CVE-2026-33226 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-33226

Vulnerability Analysis

This SSRF vulnerability exists in Budibase's REST datasource query preview functionality. The endpoint responsible for handling query previews accepts user-controlled URLs without implementing proper validation or allowlist controls. When an administrator submits a request to the /api/queries/preview endpoint, the server blindly follows the URL provided in the fields.path parameter, making HTTP requests on behalf of the attacker.

The lack of URL validation enables attackers to pivot from the Budibase server to access internal network resources that would otherwise be protected by network segmentation. This is particularly dangerous in cloud environments where instance metadata services expose sensitive credentials and configuration data at well-known IP addresses.

Root Cause

The root cause of this vulnerability is improper input validation (CWE-918: Server-Side Request Forgery). The /api/queries/preview endpoint does not implement URL allowlisting, blocklisting of internal IP ranges, or validation of the destination address before making outbound HTTP requests. The application trusts user-supplied URLs and follows redirects without verifying the final destination.

Attack Vector

The attack exploits the network-accessible REST API endpoint that requires administrator authentication. An attacker with admin credentials can craft malicious requests targeting internal infrastructure.

The exploitation flow involves submitting a POST request to /api/queries/preview with the fields.path parameter set to internal endpoints such as:

• AWS metadata service: http://169.254.169.254/latest/meta-data/
• GCP metadata service: http://metadata.google.internal/computeMetadata/v1/
• Azure metadata service: http://169.254.169.254/metadata/instance
• Internal Kubernetes API: https://kubernetes.default.svc
• Internal databases and services on private network ranges

On GCP deployments, attackers can retrieve OAuth2 tokens with cloud-platform scope by targeting the metadata service, effectively gaining full access to the GCP project. Internal network enumeration is possible on any deployment by probing internal IP ranges and service ports through the SSRF vector.

Detection Methods for CVE-2026-33226

Indicators of Compromise

• Unusual outbound requests from Budibase server to cloud metadata IP addresses (169.254.169.254, metadata.google.internal)
• POST requests to /api/queries/preview containing internal IP addresses or private network ranges in the request body
• Access logs showing queries to Kubernetes API endpoints or internal database ports from the Budibase application
• Unexpected data access patterns in cloud provider audit logs originating from Budibase server instances

Detection Strategies

• Monitor network traffic from Budibase servers for connections to RFC 1918 private address ranges and link-local addresses
• Implement alerting on API requests to /api/queries/preview that contain suspicious URL patterns in the fields.path parameter
• Review cloud provider audit logs for metadata service access from application server IP addresses
• Deploy web application firewall rules to detect SSRF payload patterns in POST request bodies

Monitoring Recommendations

• Enable verbose logging for the Budibase REST datasource query preview endpoint
• Configure network monitoring to alert on outbound connections from Budibase to internal services
• Set up cloud provider monitoring for instance metadata API access patterns
• Implement egress filtering and logging at the network perimeter for Budibase server traffic

How to Mitigate CVE-2026-33226

Immediate Actions Required

• Restrict administrative access to Budibase to trusted users only until a patch is available
• Implement network-level controls to prevent the Budibase server from reaching cloud metadata services and internal networks
• Review admin account access logs for any suspicious query preview activity
• Consider disabling the REST datasource query preview feature if not required for operations

Patch Information

At the time of publication, there are no publicly available patches for this vulnerability. Organizations should monitor the Budibase GitHub Security Advisory for updates on remediation options.

Workarounds

• Deploy network egress controls blocking access to metadata service IP addresses (169.254.169.254) from Budibase servers
• Use IMDSv2 on AWS instances with hop limit of 1 to prevent SSRF-based metadata access
• Implement a reverse proxy or WAF in front of Budibase to filter malicious URL patterns in API requests
• Segment the Budibase deployment network to limit lateral movement to internal services
• On GCP, configure metadata server firewall rules to restrict access from application workloads

# Example: Block metadata service access using iptables on Budibase server
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 169.254.0.0/16 -j DROP

# For cloud deployments, configure instance metadata service restrictions
# AWS: Enable IMDSv2 with hop limit of 1
aws ec2 modify-instance-metadata-options \
    --instance-id <instance-id> \
    --http-tokens required \
    --http-put-response-hop-limit 1