Budibase Server CVE-2026-82246

Exploitation requires a valid Budibase user account with at least low-level privileges, as the query import endpoint is not exposed to unauthenticated users (PR:L confirmed by CVSS 4.0 vector). Maximum impact occurs when the Budibase server is hosted in a cloud environment (AWS, GCP, Azure) with IMDSv1 or equivalent unauthenticated metadata access enabled - this is a non-default configuration on AWS since IMDSv2 was made the default in later instance types, but many existing deployments retain IMDSv1 compatibility. In on-premises deployments without cloud metadata services, exploitation is limited to reaching other internal network services accessible from the Budibase host, reducing but not eliminating the confidentiality risk. Exploitation is bounded by the requirement for a valid credential; unauthenticated external attackers cannot exploit this without first compromising a user account.

The CVSS 4.0 score of 7.1 with vector AV:N/AC:L/AT:N/PR:L/UI:N reflects a moderately high-severity finding that is network-reachable at low complexity, constrained only by the requirement for authenticated access (PR:L). The high vulnerable-system confidentiality impact (VC:H) is well-calibrated: SSRF against cloud metadata endpoints is a widely understood technique that can yield IAM or service-account credentials, enabling privilege escalation and lateral movement well beyond the Budibase instance itself. No EPSS data was supplied, so exploitation probability cannot be quantified from that signal; the absence of a CISA KEV entry and public POC suggests exploitation has not been observed at scale. However, SSRF-to-metadata-credential-theft requires no specialized tooling and is a well-documented attack pattern, meaning any organization running Budibase in a cloud environment - even a smaller internal deployment - should treat this as an urgent upgrade priority rather than deprioritizing it on the basis of the medium-range CVSS score alone.

An attacker with a low-privileged Budibase account submits a query import request with the URL set to http://169.254.169.254/latest/meta-data/iam/security-credentials/ on an AWS-hosted instance. The Budibase server fetches this URL using its own host network identity, and the metadata service returns temporary IAM access keys without requiring any additional authentication. The attacker extracts those credentials from the HTTP response and uses them to enumerate and access S3 buckets, invoke AWS APIs, or escalate to higher-privilege roles. No public exploit code has been identified, but this technique requires only standard HTTP tooling and knowledge of the metadata endpoint path.