CVE-2026-33226 Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview
Authenticated admins can exploit SSRF in Budibase to access internal services and steal cloud credentials via unvalidated REST datasource queries.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-33226?
CVE-2026-33226 is a high-severity server-side request forgery vulnerability in budibase, published on 20 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions from 3.30.6 and prior, the REST datasource query preview endpoint (POST /api/queries/preview) makes server-side HTTP requests to any URL supplied by the user in fields.path with no validation. An authenticated admin can reach internal services that are not exposed to the internet — including cloud metadata endpoints (AWS/GCP/Azure), internal databases, Kubernetes APIs, and other pods on the internal network. On GCP this leads to OAuth2 token theft with cloud-platform scope (full GCP access). On any deployment it enables full internal network enumeration. At time of publication, there are no publicly available patches.
Weakness: CWE-918
Which versions are affected by CVE-2026-33226?
2 open source packages ship an affected version, including budibase. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
budibase npm | All versions to 3.30.6 | None |
budibase npm | All versions to 3.30.6 | None |
Products include Budibase Budibase.
How do I fix CVE-2026-33226?
No fix has been published for CVE-2026-33226 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-33226 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33226 exists.
Other vulnerabilities in budibase
- CVE-2026-54350 Budibase: Anonymous NoSQL operator injection via published-app query templates
- CVE-2026-27702 Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)
- CVE-2026-54352 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload
- CVE-2026-31818 Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
- CVE-2026-30240 Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets
Sources
Also known as GHSA-4647-wpjq-hh7f.