vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-82246

Budibase Server before 3.41.3 SSRF via Query Import

HIGH
7.1
CVSS Score
Published: August 28, 2026 at 10:49 AM UTC
Updated: October 8, 2026 at 04:17 PM UTC
1 product affected across 1 vendorBudibase

Using server by budibase?

Get instant alerts when new vulnerabilities affect server - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.1
Exploit prediction
EPSS 0.2%
SSVC
PoC

Description

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints and other restricted network resources.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Budibase· Budibase
90%
0 ≤ v < 3.41.30
Vendor states this is fixed in 3.41.3 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (2)

Vendor Advisory
Source: cverecord
https://github.com/Budibase/budibase/security/advisories/GHSA-48x3-9ph2-p9gj
Third Party Advisory
Source: cverecord
https://www.vulncheck.com/advisories/budibase-server-before-3.41.3-ssrf-via-query-import

SSVC — Action Prioritization

SSVCPoCNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.1HIGHVulnCheck
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-918

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card