Executive brief
Budibase is a low-code application platform that allows users to create automations with integration steps (webhooks, Slack, Discord, Zapier, n8n). These automation features make outbound HTTP requests to user-supplied URLs without checking if those URLs point to internal or private IP addresses. An authenticated attacker can exploit this to reach internal databases, cloud metadata services, and administrative panels that should be inaccessible from the internet.
Technical details
This is a Server-Side Request Forgery (SSRF, CWE-918) vulnerability in Budibase's automation step implementations. The vulnerable code makes direct fetch() calls in multiple automation step modules (outgoingWebhook.ts, zapier.ts, n8n.ts, slack.ts, discord.ts) without performing any IP-based blacklist validation. Additionally, even the REST API integration's blacklist protection defaults to an empty allow-all configuration when the BLACKLIST_IPS environment variable is not set. An authenticated attacker with automation creation privileges can craft automation workflows that make HTTP requests to private IP ranges (127.0.0.1/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and link-local addresses (169.254.0.0/16), including AWS metadata endpoints. This allows exfiltration of sensitive configuration, cloud credentials, and access to internal administrative services. The vulnerability requires authenticated access but no user interaction. Patch 3.41.3 applies IP blacklist validation to all outbound HTTP requests with hardcoded defaults for private ranges.
Affected products
- Budibase @budibase/server < 3.41.3
Timeline
- 2026-08-14: disclosed
- 2026-08-14: patched: Patched in version 3.41.3