CVE-2026-82241

Name of the Vulnerable Software and Affected Versions Budibase backend-core (affected versions not specified)

Description The software fails to include the shared address space range 100.64.0.0/10 in its default Server-Side Request Forgery (SSRF) blacklist used for REST datasource query previews. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. An authenticated user with Builder permissions can send a request to the 'POST /api/queries/preview' endpoint targeting a service within the 100.64.0.0/10 range, leading the server to forward the request and return the response.

Recommendations Add 100.64.0.0/10 to the DEFAULT BLACKLIST to prevent requests to the shared address space range.