Description

Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist (DEFAULT_BLACKLIST) used by REST datasource query previews. When the default blacklist is active (i.e., a self-hosted deployment has not defined BLACKLIST_IPS), an authenticated user with the Builder permission can submit a REST datasource query preview request to POST /api/queries/preview targeting a reachable HTTP(S) service in the 100.64.0.0/10 range, causing the server to send a request to that target and return its response through the preview flow. Per the advisory, no released fix was identified at the time of publication; remediation is to add 100.64.0.0/10 to DEFAULT_BLACKLIST.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-28T12:16:34.173Z",
  "pubdate": "2026-08-28T12:16:34.173Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in @budibase/backend-core, a core component of the @budibase/server, stemming from an inadequate default security blacklist.\nThe vulnerability occurs because the 'DEFAULT_BLACKLIST' configuration omits the Carrier-Grade NAT (CGNAT) address space (100.64.0.0/10), which is commonly utilized in cloud-native and containerized environments to host internal services.\nAn attacker possessing 'Builder' permissions can exploit this oversight to perform unauthorized requests against internal HTTP(S) services that are otherwise intended to be isolated from the public internet.\nThe impact includes unauthorized access to internal APIs, potential information disclosure, and the ability to interact with metadata services or internal microservices within the host environment.\nThis issue is particularly critical for self-hosted deployments that rely on the default configuration without explicitly overriding the 'BLACKLIST_IPS' environment variable.\nSuccessful exploitation requires authenticated access to the application with specific administrative/Builder privileges, though the attack itself is performed through legitimate application functionality, specifically the REST datasource query preview feature.",
  "technicalDetails": "The vulnerability resides within the REST datasource query preview functionality of @budibase/backend-core. The application implements a request filtering mechanism designed to prevent SSRF by validating the destination IP address of outbound requests against a predefined 'DEFAULT_BLACKLIST'.\nThe root cause is an insufficient blocklist policy: the 100.64.0.0/10 address range is excluded from the default filtering logic. This address space is defined under RFC 6598 for Shared Address Space, which is frequently used in cloud orchestration platforms (such as Kubernetes or AWS VPCs) to expose internal backend services, sidecars, or management interfaces that are not intended to be reachable by external users.\nThe attack flow proceeds as follows: an attacker with 'Builder' level privileges navigates to the REST datasource configuration panel within the Budibase interface. The attacker initiates a 'preview' request, which invokes the POST /api/queries/preview endpoint. This endpoint allows the user to specify a target URL for the datasource.\nIf the attacker crafts a request targeting an IP address within the 100.64.0.0/10 range, the application's validator fails to identify this as a restricted internal address. Consequently, the backend-core component proceeds to perform a server-side HTTP(S) request to the targeted internal service.\nThe response generated by the internal service is subsequently returned to the attacker through the preview result window, effectively turning the Budibase instance into an open proxy for the internal network infrastructure.\nBecause the vulnerability exists in the core logic used by @budibase/server, any self-hosted deployment running a version where this range is omitted is inherently susceptible unless the administrator has manually redefined the 'BLACKLIST_IPS' variable.\nThis vulnerability is classified as a logic flaw in the security controls. The absence of this range in the blacklist allows the bypass of intended network segmentation, enabling an attacker to perform reconnaissance or exploit other internal vulnerabilities that assume perimeter-based trust, such as interacting with unauthenticated management endpoints."
}