CVE-2026-35219

Executive Summary

CVE-2026-35219 identifies a Server-Side Request Forgery (SSRF) vulnerability in Budibase, an open-source low-code platform, affecting versions prior to 3.41.3. An authenticated user can exploit this flaw in various automation steps to compel the Budibase server to make arbitrary requests to internal network services or cloud metadata endpoints. This can lead to sensitive information disclosure, unauthorized access to internal resources, and potential further compromise of the underlying infrastructure.

Technical Analysis

The vulnerability, classified as CWE-918 (Server-Side Request Forgery), stems from an insufficient input validation and filtering mechanism within specific automation steps of the Budibase application. The affected components are located in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and packages/server/src/automations/steps/discord.ts.

These automation steps are designed to integrate with external services by making HTTP requests. The core of the vulnerability lies in their use of the node-fetch library on user-provided URLs without enforcing the BLACKLIST_IPS mechanism that is present in the application's REST integration. The absence of this critical IP blacklist allows an authenticated attacker to supply a URL pointing to internal network resources (e.g., private IP addresses in RFC1918 ranges) or cloud provider metadata services (e.g., http://169.254.169.254 for AWS, Azure, GCP metadata APIs).

By crafting a malicious URL within an automation configuration, the attacker can force the Budibase server to initiate connections to arbitrary internal endpoints. The server acts as an unwitting proxy, retrieving content from the specified internal resource and potentially returning it to the attacker, or triggering actions on those internal services that have trust relationships with the Budibase host.

Exploitation Scenarios

Exploitation of CVE-2026-35219 requires an authenticated user account within the Budibase application. The attack chain typically proceeds as follows:

1. Reconnaissance/Target Identification: An authenticated attacker identifies a running Budibase instance. The attacker would then identify potential internal targets accessible from the Budibase server's network context. Common targets include cloud metadata services (e.g., http://169.254.169.254), internal API endpoints, databases, or administrative interfaces residing on private network segments.
2. Triggering the Flaw: The attacker logs into the Budibase application and navigates to the configuration section for automation steps. They select one of the vulnerable automation types, such as outgoingWebhook, zapier, n8n, slack, or discord.
3. Payload/Execution Method: Within the chosen automation step's configuration interface, the attacker provides a crafted URL as input. This URL points to the desired internal resource (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/ to retrieve cloud credentials, or http://192.168.1.100/admin to access an internal service). When the automation step is executed (either manually triggered or by a configured event), the Budibase server's node-fetch implementation makes a request to the attacker-supplied URL from its own network context.
4. Post-Exploitation Impact: Upon successful exploitation, the server-side request is made. The response from the internal service (e.g., cloud metadata, internal API response) can be processed or, depending on the automation step's configuration, potentially disclosed back to the attacker. This enables the attacker to perform internal network reconnaissance (e.g., port scanning), retrieve sensitive configuration data, compromise credentials (e.g., IAM role credentials), or interact with otherwise inaccessible internal services, potentially leading to data exfiltration, lateral movement, or further system compromise.

No public Proof of Concept (PoC) or exploit code is currently known; the attack chain is inferred directly from the vulnerability class and the technical details provided in the NVD description.

Impact Assessment

The impact of CVE-2026-35219 is significant due to the nature of Server-Side Request Forgery. While requiring authenticated access, successful exploitation grants the attacker powerful capabilities from the perspective of the Budibase server.

• Confidentiality: High. Attackers can access sensitive information such as cloud provider metadata (which often includes temporary security credentials for IAM roles), internal network configurations, proprietary API responses, or other data stored on internal services.
• Integrity: Moderate to High. Depending on the exposed internal services, an attacker could potentially manipulate data or configurations if the internal service's APIs allow write operations, or if sensitive credentials obtained via SSRF are then used to modify data.
• Availability: Low to Moderate. While not directly an availability vulnerability, an attacker could potentially trigger denial-of-service conditions on internal services by repeatedly making requests, or by using obtained credentials to disrupt services.
• Authentication: An authenticated user account is required to exploit this vulnerability. However, once authenticated, the attacker gains access to resources beyond their intended scope.
• Blast Radius: The blast radius extends significantly beyond the Budibase application itself. It encompasses any internal network resources and cloud services that the Budibase server has network access to. This could include other internal applications, databases, administrative panels, and sensitive cloud infrastructure components, making it a critical pivot point for internal network attacks.

The CVSS score for this vulnerability is currently N/A; however, considering the potential for broad internal network access and sensitive data exposure, it would likely rate highly in confidentiality and potentially integrity.

Detection Guidance

Sigma Rule

title: Budibase SSRF Attempt via Automation Steps
id: d00c6d70-a1b1-4f11-9257-19d261e4f4d2
status: experimental
description: Detects suspicious outbound connections from Budibase application processes to internal IP ranges or cloud metadata services, indicative of SSRF exploitation.
author: Valter Sit
date: 2026/01/01
logsource:
  category: network_connection
  product: linux
  service: auditd # Or other network flow logs like Zeek, NetFlow
detection:
  selection_process:
    Image|endswith:
      - 'budibase' # Adjust based on actual Budibase process name
      - 'node' # Budibase is Node.js-based, could be a child process
    CommandLine|contains:
      - 'packages/server/src/automations/steps/' # Heuristic for automation context
  selection_ip:
    DestinationIp:
      - '169.254.169.254' # AWS/Azure/GCP metadata service
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_process and selection_ip
falsepositives:
  - Legitimate internal integrations if not properly whitelisted.
level: high

YARA Rule

rule budibase_vulnerable_automation_code_cve_2026_35219
{
  meta:
    author = "Valter Sit"
    date = "2026-01-01"
    description = "Detects source code patterns related to Budibase automation steps using node-fetch without BLACKLIST_IPS enforcement, indicative of CVE-2026-35219 vulnerability."
    cve = "CVE-2026-35219"
    version = "1.0"
    severity = "HIGH"

  strings:
    $s1 = "packages/server/src/automations/steps/outgoingWebhook.ts" ascii wide nocase
    $s2 = "packages/server/src/automations/steps/zapier.ts" ascii wide nocase
    $s3 = "packages/server/src/automations/steps/n8n.ts" ascii wide nocase
    $s4 = "packages/server/src/automations/steps/slack.ts" ascii wide nocase
    $s5 = "packages/server/src/automations/steps/discord.ts" ascii wide nocase
    $s6 = "node-fetch" ascii wide nocase
    $s7 = "BLACKLIST_IPS" ascii wide nocase

  condition:
    (1 of ($s1, $s2, $s3, $s4, $s5)) and $s6 and not $s7
}

Suricata IDS Rule

# Detect outbound connections from Budibase server to cloud metadata service
alert http any any -> 169.254.169.254 any (msg:"VALTERSIT_CVE-2026-35219 Budibase SSRF to Cloud Metadata Detected"; flow:established,to_server; http.method; content:"GET"; classtype:attempted-user; sid:20263521901;)
alert http any any -> 169.254.169.254 any (msg:"VALTERSIT_CVE-2026-35219 Budibase SSRF to Cloud Metadata Detected"; flow:established,to_server; http.method; content:"POST"; classtype:attempted-user; sid:20263521902;)

# Detect outbound connections to private IP ranges (adjust HOME_NET and APP_SERVER_IP variables)
# Assume APP_SERVER_IP is the IP of your Budibase server
# Replace $APP_SERVER_IP with the actual IP address or range of your Budibase server(s)
# Replace $HOME_NET with your internal network range(s)
alert ip $APP_SERVER_IP any -> [10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16] any (msg:"VALTERSIT_CVE-2026-35219 Budibase SSRF to Private IP Range Detected"; flow:established,to_server; classtype:attempted-user; sid:20263521903;)

Elastic Detection

{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "event.category": "network"
          }
        },
        {
          "term": {
            "event.type": "connection"
          }
        },
        {
          "wildcard": {
            "process.name": "*budibase*" # Adjust based on actual Budibase process name
          }
        },
        {
          "bool": {
            "should": [
              {
                "ip": {
                  "destination.ip": "169.254.169.254"
                }
              },
              {
                "range": {
                  "destination.ip": {
                    "gte": "10.0.0.0",
                    "lte": "10.255.255.255"
                  }
                }
              },
              {
                "range": {
                  "destination.ip": {
                    "gte": "172.16.0.0",
                    "lte": "172.31.255.255"
                  }
                }
              },
              {
                "range": {
                  "destination.ip": {
                    "gte": "192.168.0.0",
                    "lte": "192.168.255.255"
                  }
                }
              }
            ]
          }
        }
      ]
    }
  },
  "sort": [
    {
      "@timestamp": {
        "order": "desc"
      }
    }
  ]
}

Splunk SPL Query

(index=* OR index=network OR index=os OR index=web)
(process_name="budibase*" OR parent_process_name="budibase*" OR application="budibase*")
(dest_ip="169.254.169.254" OR dest_ip=10.0.0.0/8 OR dest_ip=172.16.0.0/12 OR dest_ip=192.168.0.0/16)
| stats count by _time, host, process_name, dest_ip, dest_port, url
| `security_content_ctime(first_time)`
| `security_content_ctime(last_time)`
| `budibase_ssrf_filter`

Wazuh OSSEC Rule

<group name="syslog,linux,">
  <rule id="100001" level="10">
    <if_sid>60103,60105</if_sid> <!-- Based on existing successful connection rules for network activity -->
    <match>budibase</match> <!-- Heuristic for logs containing budibase activity -->
    <description>Budibase SSRF attempt detected - Outbound to internal or metadata IP.</description>
    <options>no_email_alert</options>
  </rule>

  <rule id="100002" level="12" overwrite="yes">
    <if_matched_sid>100001</if_matched_sid>
    <field name="dstip">^169\.254\.169\.254$|^10\.|^172\.(1[6-9]|2[0-9]|3[0-1])\.|^192\.168\.</field>
    <description>!!! ALERT !!! Budibase SSRF detected: Process connected to internal/metadata IP.</description>
    <mitre>
      <id>T1090</id>
    </mitre>
    <group>attack,ssrf,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. However, the NVD description states the issue is fixed in version 3.41.3. Therefore, "UNPATCHED" refers to the lack of external patch evidence, not the availability of a vendor fix.

1. Immediate Mitigations:

   • Network Segmentation: Implement strict outbound firewall rules on the server hosting Budibase. Restrict egress traffic from the Budibase application's network interface, specifically blocking access to private IP address ranges (RFC1918 - 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata service IP addresses (e.g., 169.254.169.254). Allow only essential outbound connections to known, legitimate external services.
   • Monitor Outbound Traffic: Actively monitor network traffic originating from the Budibase server for connections to unusual or unauthorized internal/private IP addresses or cloud metadata endpoints.
   • Least Privilege: Ensure that the Budibase application runs with the least necessary privileges. Limit its access to internal network resources and credentials.
   • User Training & Auditing: Educate authenticated Budibase users about the risks of configuring automations with untrusted URLs. Regularly audit existing automation step configurations for suspicious URLs.

2. Patch/Upgrade Steps:

   • Upgrade Budibase: The vendor has released a fix in Budibase version 3.41.3. All users of Budibase versions prior to 3.41.3 should upgrade to version 3.41.3 or later as soon as possible. Consult the official Budibase documentation and release notes for detailed upgrade instructions.

3. Long-Term Hardening:

   • API Gateway/WAF: Deploy an API Gateway or Web Application Firewall (WAF) in front of the Budibase application to inspect and filter incoming and outgoing requests, potentially blocking attempts to configure malicious URLs or outbound SSRF traffic.
   • Runtime Application Self-Protection (RASP): Consider implementing RASP solutions that can detect and prevent SSRF attempts at the application runtime level.
   • Regular Security Audits: Conduct routine security audits, including penetration testing and code reviews, specifically targeting custom integrations and automation logic to identify and remediate similar vulnerabilities.
   • Outbound Proxy: Route all outbound traffic from the Budibase server through a dedicated, hardened outbound proxy that can enforce strict URL filtering and access controls, effectively acting as the missing BLACKLIST_IPS mechanism at a network level.

References

• National Vulnerability Database (NVD) Entry: No official NVD link is available yet for CVE-2026-35219, as the CVE ID is hypothetical for this exercise.
• Budibase GitHub Release Notes (Hypothetical): Refer to the official Budibase GitHub repository for release notes of version 3.41.3, which should detail the fix for this SSRF vulnerability.
  • Example (hypothetical link structure): https://github.com/Budibase/budibase/releases/tag/v3.41.3
• CWE-918: Server-Side Request Forgery (SSRF): Detailed information on the vulnerability class.
  • https://cwe.mitre.org/data/definitions/918.html
• OWASP Server-Side Request Forgery (SSRF) Prevention Cheat Sheet: Guidance on preventing SSRF vulnerabilities.
  • https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html