CVE-2026-35219

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.41.3

Description Authenticated users can perform server-side requests to internal services and cloud metadata. This occurs because automation steps for outgoing webhooks, Zapier, n8n, Slack, and Discord use node-fetch to make HTTP requests to user-provided URLs without enforcing the BLACKLIST IPS protection. Additionally, the REST API integration blacklist defaults to empty if the BLACKLIST IPS environment variable is not configured, leaving default deployments unprotected. This allows access to private IP ranges, such as the cloud metadata endpoint http://169.254.169.254/latest/meta-data/, internal databases, admin panels, and Kubernetes APIs.

Recommendations Update to version 3.41.3. Configure the BLACKLIST IPS environment variable to include private IP ranges. Restrict the use of automation steps that allow user-provided URLs until the update is applied.