CVE-2026-35219: Budibase SSRF Vulnerability

CVE-2026-35219 Overview

Budibase is an open-source low-code platform for building internal tools and business applications. CVE-2026-35219 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting Budibase versions prior to 3.41.3. Several automation steps invoke node-fetch on user-supplied URLs without applying the BLACKLIST_IPS control that the REST integration enforces. An authenticated user can direct the Budibase server to issue requests to cloud metadata endpoints and internal network services. The issue was addressed in version 3.41.3.

Critical Impact
Authenticated attackers can pivot through Budibase automation steps to reach cloud provider metadata services (for example, 169.254.169.254) and internal-only endpoints, exposing credentials and internal application data.

Affected Products

Budibase versions prior to 3.41.3
Automation steps: outgoingWebhook.ts, zapier.ts, n8n.ts, slack.ts, discord.ts
Self-hosted Budibase deployments running in cloud environments with instance metadata services

Discovery Timeline

2026-08-17 - CVE-2026-35219 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-35219

Vulnerability Analysis

Budibase provides multiple automation steps that send HTTP requests to third-party services. The REST integration wraps outbound requests with an IP blacklist that blocks loopback, link-local, and private address ranges. The automation steps for outgoing webhooks, Zapier, n8n, Slack, and Discord bypass this control and pass user-provided URLs directly to node-fetch. An authenticated user with permission to author or execute automations can supply URLs pointing to internal targets. The server then performs the request from its own network position, returning response data or side effects to the attacker.

Root Cause

The root cause is inconsistent enforcement of the BLACKLIST_IPS control across outbound HTTP call sites. Only the REST integration applied the guard. Automation steps in packages/server/src/automations/steps/ invoked node-fetch directly, skipping validation of the destination host and IP address before the request was issued.

Attack Vector

An authenticated Budibase user configures an automation that references one of the vulnerable steps. The URL field is set to an internal or cloud metadata target such as http://169.254.169.254/latest/meta-data/iam/security-credentials/. When the automation runs, the server issues the request and returns the response body or triggers a state change on the internal service. This exposes cloud IAM credentials, internal APIs, admin interfaces, and services bound to private ranges.

typescript

// Security patch: packages/backend-core/src/blacklist/blacklist.ts
// Adds the carrier-grade NAT range 100.64.0.0/10 to the SSRF blacklist
// and, per PR #19328, applies the blacklist to automation webhook steps.
   "10.0.0.0/8",
   "172.16.0.0/12",
   "192.168.0.0/16",
+  "100.64.0.0/10",
   "169.254.0.0/16",
   "0.0.0.0/8",
   "::1/128",

Source: Budibase commit cc07563

Detection Methods for CVE-2026-35219

Indicators of Compromise

Outbound HTTP requests from the Budibase server process to 169.254.169.254, fd00:ec2::254, or other cloud metadata endpoints
Automation execution logs referencing URLs targeting RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback addresses
Unexpected access to internal admin interfaces originating from the Budibase host
Creation or modification of automations using outgoingWebhook, zapier, n8n, slack, or discord steps with unusual URL destinations

Detection Strategies

Inspect automation definitions in the Budibase database for step URLs pointing to private, loopback, or metadata IP ranges
Correlate Budibase application logs with network flow data to identify server-initiated connections to internal subnets
Alert on node-fetch User-Agent traffic from the Budibase server reaching addresses outside the expected third-party SaaS endpoints

Monitoring Recommendations

Enable egress logging on the Budibase host and forward events to a centralized analytics platform for query and retention
Monitor cloud provider metadata service access logs where supported (for example, IMDSv2 request counters in AWS CloudTrail)
Track new or modified automation records and flag URL fields matching internal CIDR patterns

How to Mitigate CVE-2026-35219

Immediate Actions Required

Upgrade Budibase to version 3.41.3 or later, which applies BLACKLIST_IPS enforcement to the affected automation steps
Audit existing automations for webhook, Zapier, n8n, Slack, and Discord steps referencing internal or metadata URLs
Rotate any cloud IAM credentials, API tokens, or secrets reachable from the Budibase host if exposure is suspected
Restrict automation authoring permissions to trusted users pending remediation

Patch Information

The fix is delivered in Budibase release 3.41.3 and merged via pull request #19328. Full technical detail is available in the GitHub Security Advisory GHSA-5fpj-28rv-84r7 and the patch commit.

Workarounds

Enforce IMDSv2 with hop-limit 1 on AWS EC2 instances hosting Budibase to block metadata access from the application process
Apply egress network policies that deny traffic from the Budibase container or host to RFC1918, link-local, and loopback ranges
Place Budibase behind an outbound proxy that filters destinations against an allowlist of known third-party SaaS endpoints

bash

# Example: restrict AWS EC2 metadata to IMDSv2 with a hop limit of 1
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled