CVE-2026-82246

Executive Summary

CVE-2026-82246 is a server-side request forgery (SSRF) vulnerability affecting Budibase Server versions prior to 3.41.3. The flaw resides in the query import endpoint, which fails to validate user-supplied URLs before fetching content, allowing authenticated attackers to submit arbitrary URLs and retrieve responses from internal services, including cloud metadata endpoints (e.g., AWS IMDS, Azure IMDS) and other restricted network resources. With a CVSS score of 7.1 (High), the vulnerability presents a significant confidentiality risk, potentially exposing credentials, internal network topology, and sensitive data. Organizations running affected Budibase instances should treat this as a high-priority remediation target despite the absence of a formal patch confirmation.

Technical Analysis

The vulnerability is classified under CWE-918 (Server-Side Request Forgery) and arises from a failure to validate user-supplied URLs within the query import functionality of Budibase Server. The query import endpoint is designed to facilitate the ingestion of data from external sources by allowing users to specify a URL from which content is fetched and subsequently imported into the Budibase platform. The flaw permits an attacker to supply URLs pointing to internal network resources that would otherwise be inaccessible from the public internet.

The underlying mechanism is rooted in the absence of both allow-list and deny-list validation on the URLs processed by the endpoint. In a properly secured implementation, the server should restrict fetch operations to a predefined set of allowed domains or IP ranges and explicitly block access to loopback addresses (127.0.0.0/8), link-local addresses (169.254.0.0/16), private RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and cloud metadata IPs. The endpoint accepts the URL supplied by the user and performs an HTTP request on behalf of the server, passing the response back to the user. This creates a classic SSRF primitive: the server acts as a proxy, relaying internal service responses to the authenticated attacker.

The attack surface is the HTTP interface of the Budibase server, accessible to any authenticated user with permissions to use the query import feature. Since the privilege required is Low, a standard user account — not necessarily an administrator — is sufficient to trigger the vulnerability. The scope is Unchanged (S:U), meaning the impact is confined to the server and its reachable network resources, but the Confidentiality impact is High (C:H), reflecting the ability to exfiltrate sensitive data from internal services. The Integrity impact is Low (I:L), potentially allowing limited data modification such as writing to internal endpoints that accept POST requests.

The vulnerability is noteworthy because cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/) often contain temporary credentials. Successful retrieval of these credentials could allow lateral movement within the cloud environment and further compromise of associated resources.

Exploitation Scenarios

No public exploit code or PoC has been identified for this vulnerability as of the report date; however, the attack chain can be reasonably inferred from the SSRF vulnerability class and the NVD description. The following scenario assumes a minimally privileged authenticated user on an internet-facing Budibase server.

Step 1 — Reconnaissance/Target Identification: The attacker identifies internet-facing Budibase instances. Budibase serves a distinct web interface; reconnaissance can be performed via search engines such as Shodan or Fofa using application-specific banners. The attacker then creates or compromises a low-privileged user account on the target instance. If the platform exposes self-registration, account creation is trivial; otherwise, the attacker may use credential stuffing or phishing to obtain credentials.

Step 2 — Triggering the Flaw: The attacker logs in and navigates to the query creation/import functionality within the Budibase dashboard. The query import endpoint is used to create a new query where the data source is defined by a URL. Instead of specifying a legitimate external resource, the attacker supplies a URL targeting an internal resource. Example payloads at the class level include:

• http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS cloud metadata)
• http://127.0.0.1:8080/ (local services)
• http://192.168.1.100:9200/ (internal Elasticsearch or other services)

Because the endpoint does not validate or filter these URLs, the server processes the request.

Step 3 — Execution Method: The server-side HTTP client sends the request to the supplied URL, fetches the content, and returns the response through the application's import result display or error messages. The attacker observes the response in the application UI or via the associated API response. For the cloud metadata example, the response contains IAM temporary credentials (AccessKeyId, SecretAccessKey, Token) that the attacker captures.

Step 4 — Post-Exploitation Impact: Armed with internal service responses, the attacker can exfiltrate configuration files, database contents, or other sensitive data from internal endpoints. If cloud metadata credentials are obtained, the attacker may assume the attached IAM role and access S3 buckets, EC2 instances, or other cloud resources. The low integrity impact may allow submitting data to internal APIs that lack CSRF protections, such as writing to configuration endpoints or triggering internal actions. In environments where the Budibase server has broad network access (e.g., connected to a VPC with multiple services), the blast radius can extend substantially.

Note: No public PoC is available; the above chain is inferred from the vulnerability class and standard SSRF exploitation patterns.

Impact Assessment

CVSS Analysis: The vulnerability carries a CVSS score of 7.1 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. The network attack vector (AV:N) indicates remote exploitability. Low attack complexity (AC:L) means no special conditions are required beyond reaching the endpoint. Low privileges (PR:L) are needed, meaning a standard user account suffices. No user interaction (UI:N) is required. The scope is unchanged (S:U). Confidentiality impact is High (C:H) — this is the primary driver of the severity, reflecting the potential for complete disclosure of information from internal systems reachable by the server. Integrity impact is Low (I:L), allowing limited data modification. Availability is not impacted (A:N).

Affected Systems: All Budibase Server deployments running versions earlier than 3.41.3 are vulnerable. This includes self-hosted instances and enterprise deployments where the query import feature is exposed to authenticated users. Organizations using Budibase in cloud environments (AWS, Azure, GCP) face heightened risk because the metadata service is reachable via a well-known link-local address (169.254.169.254).

Blast Radius: In a typical deployment, the Budibase server sits inside a network segment with access to databases, internal APIs, configuration management tools, and potentially the cloud metadata service. Successful exploitation could disclose internal service credentials, database connection strings, and sensitive application data. In serverless or containerized environments, the server may also have access to orchestration APIs (e.g., Docker socket, Kubernetes API) depending on configuration. The combination of High confidentiality impact and the ease of exploitation makes this a credible and attractive target for attackers seeking initial access or data theft.

Detection Guidance

Detection for SSRF exploitation can focus on both network-level anomalies (outbound connections to internal addresses from the Budibase server) and application-level indicators (unusual query import requests).

Sigma Rule

title: Budibase Query Import SSRF - Outbound Connection to Internal IP
id: 9f6a5f2e-3c42-4a6e-9a2b-0c49d4f5a6e7
status: experimental
description: Detects Budibase server making outbound HTTP requests to internal IP ranges, indicating possible SSRF exploitation via the query import endpoint.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-82246
author: vartersit Security Research
date: 2026/01/15
logsource:
    category: network_connection
    product: linux
detection:
    selection:
        DestinationIp|startswith:
            - '10.'
            - '192.168.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.20.'
            - '172.21.'
            - '172.22.'
            - '172.23.'
            - '172.24.'
            - '172.25.'
            - '172.26.'
            - '172.27.'
            - '172.28.'
            - '172.29.'
            - '172.30.'
            - '172.31.'
            - '169.254.'
            - '127.'
        DestinationPort:
            - 80
            - 443
            - 8080
        # Budibase server process initiating the connection
        Image|contains: 'budibase'
    condition: selection
level: high
falsepositives:
    - Legitimate Budibase integrations with internal services using private IPs
    - Monitoring agents running on the same host
fields:
    - DestinationIp
    - DestinationPort
    - Image
    - User
tags:
    - attack.t1190
    - attack.t1008
    - cve.2026.82246

YARA Rule

rule Budibase_SSRF_Query_Import_Payloads
{
    meta:
        author = "vartersit Security Research"
        description = "Detects SSRF payloads targeting Budibase query import vulnerability CVE-2026-82246"
        date = "2026-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-82246"
        severity = "high"
        cve = "CVE-2026-82246"
    strings:
        $metadata_aws = "169.254.169.254" ascii wide nocase
        $metadata_azure = "http://169.254.169.254/metadata" ascii wide nocase
        $metadata_gcp = "metadata.google.internal" ascii wide nocase
        $loopback = "127.0.0.1" ascii wide nocase
        $localhost = "localhost" ascii wide nocase
        $private_10 = "http://10." ascii wide nocase
        $private_192 = "http://192.168." ascii wide nocase
        $private_172 = "http://172.16." ascii wide nocase
        $docker_socket = "/var/run/docker.sock" ascii wide nocase
        $k8s_api = "kubernetes.default.svc" ascii wide nocase
        $query_param = "importQuery" ascii wide nocase
        $query_param2 = "queryImport" ascii wide nocase
        $url_param = "\"url\"" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464c457f
        and 2 of them
        and ($query_param or $query_param2)
        and ($metadata_aws or $metadata_azure or $metadata_gcp or $loopback or
             $localhost or $private_10 or $private_192 or $private_172 or
             $docker_socket or $k8s_api)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Budibase Query Import SSRF Attempt (CVE-2026-82246)"; flow:established,to_server; content:"POST"; http_method; content:"/api/"; http_uri; content:"import"; http_uri; content:"url"; http_client_body; pcre:"/(?:169\.254\.169\.254|127\.0\.0\.1|10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|192\.168\.[0-9]{1,3}\.[0-9]{1,3}|172\.(?:1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3})/Ui"; classtype:attempted-recon; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-82246; sid:202682246; rev:1;)

Elastic Detection

// Detect outbound connections from the Budibase server process to internal IP ranges
network where process.name == "budibase" and
  (
    cidrMatch(destination.ip, "10.0.0.0/8") or
    cidrMatch(destination.ip, "172.16.0.0/12") or
    cidrMatch(destination.ip, "192.168.0.0/16") or
    cidrMatch(destination.ip, "169.254.0.0/16") or
    cidrMatch(destination.ip, "127.0.0.0/8")
  )

Splunk SPL Query

index=network sourcetype=netflow OR sourcetype=conn_log
| search process_name=budibase
| where CIDR_MATCH(dest_ip, "10.0.0.0/8") OR CIDR_MATCH(dest_ip, "172.16.0.0/12") OR
        CIDR_MATCH(dest_ip, "192.168.0.0/16") OR CIDR_MATCH(dest_ip, "169.254.0.0/16") OR
        CIDR_MATCH(dest_ip, "127.0.0.0/8")
| stats count by src_ip, dest_ip, dest_port, process_name, _time
| sort - _time
| table _time, src_ip, dest_ip, dest_port, process_name, count

Wazuh OSSEC Rule

<group name="budibase, ssrf,">
    <rule id="100250" level="10">
        <if_sid>80700</if_sid>
        <match>budibase</match>
        <regex>(169\.254\.169\.254|127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[01])\.\d{1,3}\.\d{1,3})</regex>
        <description>Budibase server attempted connection to internal/loopback address - possible SSRF exploitation (CVE-2026-82246)</description>
        <group>budibase,ssrf,cve_2026_82246,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
    <rule id="100251" level="8">
        <if_sid>100250</if_sid>
        <match>error|failed</match>
        <description>Budibase SSRF attempt with possible failed connection</description>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED). No patch evidence has been identified from any tracked source at the time of writing. The vendor has not released an official advisory, and the fix status is unconfirmed for most deployments. However, the NVD description references Budibase Server version 3.41.3 as the fixed version, indicating that a remediation may be available in that release.

1) Immediate Mitigations:

• Upgrade to Budibase Server 3.41.3 if available in your deployment channel. This version is referenced in the NVD description as the fixed release. Verify integrity of the upgrade package via the official Budibase repository or release notes.
• Restrict Network Egress: Implement outbound firewall rules on the Budibase server to block access to link-local (169.254.0.0/16), loopback (127.0.0.0/8), and private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) unless explicitly required for legitimate business functions. Deny access to the cloud metadata service at the network level (e.g., AWS instance metadata service hop-limit configuration).
• Disable or Restrict the Query Import Feature: If the query import endpoint is not essential for your operations, disable it via the application configuration or remove the associated permissions from all non-admin user roles. This directly removes the attack surface.
• Enforce Least Privilege: Audit user accounts and revoke access to the query import feature from users who do not require it. Limit the feature to administrators or a restricted group of trusted users.

2) Patch/Upgrade Steps:

• Monitor the official Budibase GitHub repository and release channels for security advisories related to CVE-2026-82246.
• Plan and execute an upgrade to version 3.41.3 or the latest stable release that includes the fix. Follow the vendor's upgrade documentation, backup your data before upgrading, and test in a staging environment first.
• After upgrade, verify the query import endpoint behavior using controlled tests to confirm URL validation is enforced.

3) Long-Term Hardening:

• Implement an Application Layer Proxy Allow-list: Future Budibase deployments should be configured to enforce an allow-list of permitted domains/IPs for URL-fetching features, rejecting any URL not explicitly approved.
• Cloud Metadata Service Protection: For cloud-hosted deployments, enable the Instance Metadata Service Version 2 (IMDSv2) and set the session hop limit to 1 (or a minimal value) to reduce the risk of SSRF-based metadata theft. Consider disabling the metadata service entirely for instances where it is not needed.
• Network Segmentation: Place the Budibase server in a dedicated network segment with strict firewall rules, allowing outbound connections only to trusted internal services and the internet, if required.
• Continuous Monitoring: Deploy the detection rules provided above (Sigma, Suricata, Elastic EQL, Splunk SPL, Wazuh) to monitor for outbound connections to internal IPs from the Budibase process. Tune rules to suppress false positives while maintaining high sensitivity to exploitation attempts.
• Vulnerability Management: Track CVE-2026-82246 in your vulnerability management system and schedule regular reviews of Budibase security advisories. Since EPSS scoring has not been assigned and no CISA KEV listing exists, prioritize based on the CVSS score of 7.1 and your organization's exposure.

References

1. NVD Entry for CVE-2026-82246: https://nvd.nist.gov/vuln/detail/CVE-2026-82246
2. Budibase Official Website: https://budibase.com (for release notes and advisory monitoring)
3. Budibase GitHub Repository: https://github.com/Budibase/budibase (for patch verification and issue tracking)
4. CWE-918 Server-Side Request Forgery: https://cwe.mitre.org/data/definitions/918.html
5. CISA Known Exploited Vulnerabilities Catalog (no listing for this CVE as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Activity: No threat actor campaigns, exploit-in-the-wild evidence, or public research relating to active exploitation of CVE-2026-82246 have been identified at the time of this writing. The absence of a confirmed patch and public exploit code may change as the vulnerability receives broader analysis. Security teams should monitor Budibase community forums and security mailing lists for emerging information.