CVE-2026-82241 in server
Summary
by MITRE • 08/28/2026
Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist (DEFAULT_BLACKLIST) used by REST datasource query previews. When the default blacklist is active (i.e., a self-hosted deployment has not defined BLACKLIST_IPS), an authenticated user with the Builder permission can submit a REST datasource query preview request to POST /api/queries/preview targeting a reachable HTTP(S) service in the 100.64.0.0/10 range, causing the server to send a request to that target and return its response through the preview flow. Per the advisory, no released fix was identified at the time of publication; remediation is to add 100.64.0.0/10 to DEFAULT_BLACKLIST.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability in question represents a Server-Side Request Forgery (SSRF) flaw within the backend-core component of Budibase, specifically affecting REST datasource query previews. SSRF vulnerabilities occur when an application fetches a remote resource without validating the user-supplied URL, allowing attackers to coerce the application into sending crafted requests to unexpected destinations. In this specific instance, the root cause lies in the configuration of the DEFAULT_BLACKLIST used by the server's HTTP client logic. This blacklist is designed to prevent internal network access and restrict outbound connections to safe or expected endpoints. However, it fails to include the 100.64.0.0/10 CIDR block, which is reserved for carrier-grade NAT (CGNAT) environments as defined by RFC 6598. This omission creates a significant gap in the security perimeter, particularly for self-hosted deployments that rely on default configurations rather than custom blacklists.
From an operational perspective, this flaw allows authenticated users with Builder permissions to exploit the REST datasource preview functionality. By submitting a POST request to /api/queries/preview and specifying a target URL within the 100.64.0.0/10 range, an attacker can force the Budibase server to initiate HTTP or HTTPS connections to services running on private networks that are otherwise inaccessible from the public internet. If such internal services exist in the CGNAT space reachable by the deployment environment, the server will retrieve their responses and return them through the preview flow interface. This mechanism effectively bypasses network-level isolation controls, enabling potential data exfiltration or reconnaissance of internal infrastructure components that should remain hidden from application users.
The impact of this vulnerability is compounded by its classification under CWE-918, which addresses Server-Side Request Forgery flaws involving URL validation issues. Furthermore, the attack vector aligns with MITRE ATT&CK technique T1571, specifically relating to Non-Standard Ports or Protocols if the internal services use non-standard configurations, and generally falls under lateral movement patterns where an attacker uses a compromised application as a pivot point. Since no released fix was identified at the time of publication, immediate remediation is critical for self-hosted instances. Administrators must manually configure the BLACKLIST_IPS environment variable or modify the source code to explicitly add 100.64.0.0/10 to the DEFAULT_BLACKLIST list. This ensures that any attempt to access resources within this reserved range is blocked, thereby restoring the intended security boundaries and preventing unauthorized internal network probing via the application's API endpoints.