CVE-2026-35219

HighCVSS 7.1

Published: 17/08/2026(UTC)Updated: 18/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

38th percentile - higher than 38% of all known CVEs

Summary

Budibase prior to version 3.41.3 has a vulnerability in automation steps (outgoingWebhook, zapier, n8n, slack, discord) where they use node-fetch on user-provided URLs without the BLACKLIST_IPS enforcement, allowing an authenticated user to make server-side requests to cloud metadata and internal services.

Risk Assessment

An attacker could access internal network resources or cloud metadata, potentially leading to sensitive information disclosure or privilege escalation.

Recommendation

Upgrade Budibase to version 3.41.3, which contains the fix.

Original NVD description (English source)

Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and packages/server/src/automations/steps/discord.ts use node-fetch on user-provided URLs without the BLACKLIST_IPS enforcement used by the REST integration, allowing an authenticated user to make server-side requests to cloud metadata and internal services. This issue is fixed in version 3.41.3.