CVE-2026-33226: Budibase unrestricted SSRF in REST datasource query preview

CVE-2026-33226 · Severity: high · CVSS 8.7 · Published 2026-03-20

Budibase is a low-code application platform that allows administrators to build apps and automations. The REST datasource query preview feature allows authenticated admins to execute arbitrary server-side HTTP requests without validation, enabling them to access internal cloud metadata services, databases, and Kubernetes APIs that should be isolated from the internet. On cloud platforms like GCP, this can result in theft of cloud access tokens granting full administrative control over cloud resources.

Technologies: Budibase, budibase (npm). Vendors: Budibase, npm.

Quick answers

Is CVE-2026-33226 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33226 being exploited in the wild.
How severe is CVE-2026-33226?
High severity, with a CVSS score of 8.7, published 20 March 2026.
Which products and versions are affected?
budibase (npm) SEMVER:introduced=0,last_affected=3.30.6.
Is there a fix for CVE-2026-33226?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-33226 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-33226?
Check whether you run Budibase or budibase (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) in the POST /api/queries/preview endpoint (packages/server/src/api/controllers/query.ts, preview() handler). The endpoint accepts a user-supplied URL in the fields.path parameter and passes it directly to the REST HTTP client without any validation of IP ranges, hostnames, or domains. No blocklist exists for loopback (127.0.0.1, ::1), RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local/cloud metadata (169.254.0.0/16), or Kubernetes internal DNS (.svc.cluster.local). An authenticated admin or builder user can exploit this by supplying a datasourceId (trivially obtained via GET /api/datasources or created on-demand) and a malicious path parameter to reach internal services including cloud metadata endpoints (AWS/GCP/Azure), internal databases, Kubernetes APIs, and other internal pods. Confirmed impact includes GCP OAuth2 token theft from 169.254.169.254, CouchDB access, MinIO and Redis enumeration, and K8s API access via mounted service account tokens. Patched versions have not been released as of the advisory date.

Affected products

  • Budibase budibase <=3.30.6

Identifiers

  • CVE-2026-33226
  • GHSA-4647-wpjq-hh7f

Timeline

  • 2026-03-18: disclosed: Advisory GHSA-4647-wpjq-hh7f published
  • 2026-03-20: advisory: CVE-2026-33226 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.