Budibase Server CVE-2026-82241

Exploitation requires an account with the Builder permission on a self-hosted Budibase instance - Builder is a named privilege tier that grants access to datasource query preview functionality. The deployment must be relying on the DEFAULT_BLACKLIST, meaning the BLACKLIST_IPS environment variable has not been defined (defining it with any value replaces DEFAULT_BLACKLIST). A reachable HTTP or HTTPS service must exist within 100.64.0.0/10 from the Budibase server's network perspective - this depends entirely on the hosting environment, making the vulnerability inert in networks where 100.64.0.0/10 is not routed internally. Exploitation is limited by: (1) required Builder-role authentication, ruling out anonymous or Viewer-only users; (2) self-hosted deployment context with no BLACKLIST_IPS override; (3) environment-specific presence of a target service on 100.64.0.0/10. Cloud-managed Budibase.com is not referenced as affected.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N) scores 7.1, reflecting a network-accessible, low-complexity exploit requiring only Builder-level privileges with no user interaction, and high confidentiality impact from exposed internal service data. Real-world risk is significantly gated by deployment context: the vulnerability applies only to self-hosted Budibase instances that have not defined BLACKLIST_IPS, and only in network environments where 100.64.0.0/10 addresses front reachable internal services (CGNAT, specific cloud configurations). Organizations whose Budibase server cannot route to 100.64.0.0/10 are not materially exposed. EPSS data is not available in the provided intelligence. No KEV listing exists and no public POC has been identified, suggesting this has not been broadly weaponized. The primary risk profile is insider threat or compromised Builder-role credential scenarios in sensitive self-hosted environments. The high VC score is appropriate for environments where 100.64.0.0/10 services expose credentials, configuration, or metadata - but this is infrastructure-dependent.

An authenticated Budibase Builder submits a REST datasource query preview via POST /api/queries/preview with a target URL pointing to an HTTP service within 100.64.0.0/10 - for example, a cloud provider's internal management API or a CGNAT-routed microservice reachable from the Budibase host. The server processes the request through the incomplete DEFAULT_BLACKLIST, forwards it to the target, and returns the full HTTP response body to the Builder through the standard preview response, exposing internal service content such as configuration data, credentials, or tokens. No public proof-of-concept code has been identified.