CVE-2026-82246CWE-918ssrf

CVE-2026-82246

High · published August 28, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
11.7
In the wild
Unconfirmed
What it is

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints and other restricted network resources.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00219 · 11.7th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-08-28T16:16Z
References (3)
https://github.com/Budibase/budibase/security/advisories/GHSA-48x3-9ph2-p9gj · [email protected]https://www.vulncheck.com/advisories/budibase-server-before-3.41.3-ssrf-via-query-import · [email protected]https://github.com/Budibase/budibase/security/advisories/GHSA-48x3-9ph2-p9gj · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 28 AUG 10:49Z
    Budibase Server before 3.41.3 SSRF via Query Import
    cvelistv5