CVE-2026-82246 Overview
CVE-2026-82246 is a server-side request forgery (SSRF) vulnerability in Budibase Server versions prior to 3.41.3. The query import endpoint fetches content from user-supplied URLs without validating the target destination. Authenticated attackers can direct the server to issue HTTP requests against internal network resources, including cloud provider metadata services. The flaw is classified under CWE-918: Server-Side Request Forgery.
Critical Impact
Attackers with low-privilege access can retrieve responses from internal services and cloud metadata endpoints, exposing credentials, session tokens, and internal application data.
Affected Products
- Budibase Server versions prior to 3.41.3
- Self-hosted Budibase deployments exposing the query import endpoint
- Cloud-hosted Budibase instances running vulnerable builds
Discovery Timeline
- 2026-08-28 - CVE-2026-82246 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-82246
Vulnerability Analysis
Budibase is a low-code platform for building internal tools and business applications. The query import feature allows users to load external API definitions by providing a URL. According to the GitHub Security Advisory GHSA-48x3-9ph2-p9gj, the endpoint accepted arbitrary URLs and fetched their contents server-side without filtering the destination host or scheme.
An attacker with a valid Budibase account submits a crafted URL pointing to an internal address. The server issues the outbound request from its own network position and returns the response body to the attacker. This bypasses network segmentation that would otherwise prevent the attacker from reaching those hosts directly.
Root Cause
The root cause is missing destination validation in the query import handler. The endpoint does not enforce an allowlist of external hosts, block private IP ranges (RFC 1918), reject loopback addresses, or filter link-local ranges such as 169.254.169.254. The VulnCheck advisory documents the missing URL validation logic in versions before 3.41.3.
Attack Vector
Exploitation requires network access to the Budibase application and low-privilege authentication. The attacker submits a URL such as http://169.254.169.254/latest/meta-data/ to the query import endpoint in cloud deployments. On AWS, this returns Instance Metadata Service (IMDSv1) responses including IAM role credentials when IMDSv2 is not enforced. Attackers can also probe internal HTTP services, databases with HTTP interfaces, and administrative panels reachable from the server. No specialized tooling is required beyond an HTTP client.
No verified public exploit code is available. See the GitHub Security Advisory for vendor-provided technical detail.
Detection Methods for CVE-2026-82246
Indicators of Compromise
- Outbound HTTP requests from the Budibase server process to 169.254.169.254, 127.0.0.1, or RFC 1918 address ranges not associated with normal application traffic
- Query import API calls containing URLs referencing internal hostnames, loopback addresses, or cloud metadata endpoints
- Unexpected retrieval of cloud instance metadata paths such as /latest/meta-data/iam/security-credentials/ in server access logs
Detection Strategies
- Inspect Budibase application logs for query import requests where the target URL resolves to private, loopback, or link-local addresses
- Correlate egress traffic from the Budibase host against the expected set of upstream API destinations and alert on deviations
- Monitor for use of exfiltrated AWS, Azure, or GCP credentials that match the identity of the Budibase workload role
Monitoring Recommendations
- Enable verbose HTTP request logging on the Budibase server and forward logs to a central SIEM for retention and correlation
- Instrument cloud metadata service access logging (for AWS, enable IMDSv2 and monitor IMDS calls per instance)
- Alert on new or anomalous outbound connections initiated by the Budibase service account
How to Mitigate CVE-2026-82246
Immediate Actions Required
- Upgrade Budibase Server to version 3.41.3 or later, which adds URL validation to the query import endpoint
- Rotate any cloud credentials, API tokens, or secrets accessible from the Budibase host if exposure is suspected
- Enforce IMDSv2 on AWS instances hosting Budibase to require session-based token authentication for metadata access
- Restrict Budibase user accounts and review who holds permissions to invoke the query import functionality
Patch Information
Budibase released version 3.41.3 addressing the SSRF vulnerability. The fix introduces URL validation in the query import endpoint that rejects requests targeting internal, loopback, and link-local addresses. Refer to the GitHub Security Advisory GHSA-48x3-9ph2-p9gj for the full patch notes.
Workarounds
- Place the Budibase server behind an egress proxy that blocks requests to private IP ranges, loopback addresses, and cloud metadata endpoints
- Apply host-based firewall rules denying outbound traffic from the Budibase process to 169.254.169.254 and internal network ranges not required for operation
- Disable or restrict access to the query import feature through role-based access control until the patch is applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
