CVE-2026-82241: Budibase Backend-Core SSRF Vulnerability

CVE-2026-82241 Overview

CVE-2026-82241 is a Server-Side Request Forgery (SSRF) vulnerability in Budibase @budibase/backend-core, as consumed by @budibase/server. The default SSRF blacklist (DEFAULT_BLACKLIST) used by REST datasource query previews omits the shared address space range 100.64.0.0/10 defined in [CWE-918]. An authenticated user holding the Builder permission can submit a crafted preview request to POST /api/queries/preview that targets HTTP(S) services reachable within that carrier-grade NAT range. The server proxies the request and returns the response body through the preview flow, enabling access to otherwise unreachable internal services.

Critical Impact
Authenticated Builders can reach internal HTTP(S) services in the 100.64.0.0/10 range and exfiltrate their responses through Budibase's query preview endpoint.

Affected Products

@budibase/backend-core (default blacklist configuration)
@budibase/server (self-hosted deployments consuming backend-core defaults)
Any Budibase self-hosted deployment where BLACKLIST_IPS is not explicitly defined

Discovery Timeline

2026-08-28 - CVE-2026-82241 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-82241

Vulnerability Analysis

Budibase supports REST datasources whose queries can be previewed from the builder interface. The backend applies an IP-based blacklist to outbound requests to prevent SSRF against internal ranges. The default blacklist enumerates common private ranges but omits 100.64.0.0/10, the Shared Address Space reserved by RFC 6598 for carrier-grade NAT and used by many cloud providers, VPN overlays, and Kubernetes environments for internal service routing.

Because the check occurs against a static list rather than a comprehensive private-address policy, requests destined for 100.64.0.0/10 bypass filtering. The preview handler then executes the outbound HTTP(S) call and returns the response payload to the requesting Builder, disclosing content from services that assumed network reachability equated to trust.

Root Cause

The root cause is an incomplete deny list in DEFAULT_BLACKLIST within @budibase/backend-core. The list fails to include the RFC 6598 shared address range, so the blacklist check permits outbound requests to targets in 100.64.0.0/10 when operators have not overridden the value using the BLACKLIST_IPS environment variable.

Attack Vector

Exploitation requires an authenticated account with the Builder permission on a self-hosted Budibase instance running default configuration. The attacker sends a POST /api/queries/preview request describing a REST datasource query whose URL points to an internal HTTP(S) endpoint within 100.64.0.0/10. The server issues the request server-side and returns the response through the preview API. Attackers can enumerate metadata services, internal admin panels, or cloud-provider control planes reachable through carrier-grade NAT overlays. No public proof-of-concept code has been published at the time of writing; refer to the GitHub Security Advisory GHSA-9754 and the VulnCheck Advisory on Budibase SSRF for technical details.

Detection Methods for CVE-2026-82241

Indicators of Compromise

Outbound HTTP(S) connections from the Budibase server process to addresses in 100.64.0.0/10 that do not correspond to legitimate datasources.
POST /api/queries/preview requests in Budibase access logs whose payload references target hosts in the 100.64.0.0/10 range.
Unexpected response bodies returned from the preview endpoint containing internal service banners, cloud metadata JSON, or admin interface HTML.

Detection Strategies

Parse Budibase application logs for /api/queries/preview invocations and correlate the target URL against RFC 1918 and RFC 6598 ranges.
Inspect egress network telemetry for Budibase workloads and alert on any flow destined for 100.64.0.0/10 that was not previously baselined.
Audit Builder role assignments and flag accounts that submitted preview requests to non-production internal hosts.

Monitoring Recommendations

Forward Budibase HTTP access logs and container egress metadata to your SIEM or data lake for correlation with authentication events.
Alert on any preview request whose response size or status pattern deviates from historical REST datasource baselines.
Track changes to the BLACKLIST_IPS environment variable and container image versions across deployments.

How to Mitigate CVE-2026-82241

Immediate Actions Required

Set the BLACKLIST_IPS environment variable on every Budibase deployment to include 100.64.0.0/10 alongside the standard private ranges.
Review the Builder role membership and revoke access for accounts that no longer require datasource authoring privileges.
Restrict egress from the Budibase server at the network layer so it can only reach approved datasource destinations.

Patch Information

Per the advisory, no released fix was identified at the time of publication. Remediation guidance from the vendor is to extend DEFAULT_BLACKLIST (or override it via BLACKLIST_IPS) to include 100.64.0.0/10. Track the GitHub Security Advisory GHSA-9754 for a released patch.

Workarounds

Define BLACKLIST_IPS explicitly to cover 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16, and 100.64.0.0/10 before restarting Budibase services.
Deploy Budibase behind an egress proxy or network policy that denies traffic to shared-address-space and metadata ranges.
Temporarily disable REST datasource preview functionality for untrusted Builder accounts until the deny list is updated.

bash

# Configuration example
export BLACKLIST_IPS="10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.0/8,169.254.0.0/16,100.64.0.0/10"