CVE-2026-82246

Name of the Vulnerable Software and Affected Versions Budibase Server versions prior to 3.41.3

Description An issue exists in the query import endpoint where the system fails to validate user-supplied URLs before fetching content. This allows attackers to perform a Server-Side Request Forgery (SSRF)—a technique where a server is tricked into making requests to an unintended location—to retrieve responses from internal services, including cloud metadata endpoints and other restricted network resources.

Recommendations Update Budibase Server to version 3.41.3 or later.