CVE-2026-35219: 
JavaScript vulnerability analysis and mitigation

CVE-2026-35219 is a Server-Side Request Forgery (SSRF) vulnerability in Budibase's automation step modules (outgoing webhook, Zapier, n8n, Slack, Discord, Make.com) that allows authenticated users to trigger server-side HTTP requests to arbitrary URLs, including internal IP addresses and private networks. Affecting @budibase/server npm package versions prior to 3.41.3, it was published and patched on August 14, 2026. The vulnerability carries a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Budibase Advisory).

The root cause (CWE-918) is that all automation step modules — outgoingWebhook.ts, zapier.ts, n8n.ts, slack.ts, discord.ts — invoke node-fetch directly via fetch(url, request) without routing through any IP validation or blacklist check. While the REST API integration does include a blacklist check (blacklist.isBlacklisted(url)), the BLACKLIST_IPS environment variable defaults to undefined, causing the blacklist array to be empty and all URLs to pass validation by default. An authenticated attacker with permission to create or modify automation workflows can supply arbitrary URLs — including RFC 1918 private ranges, loopback addresses, or cloud metadata endpoints like http://169.254.169.254/latest/meta-data/ — as the target of these automation steps (GitHub Advisory, Budibase Advisory).

Successful exploitation allows an authenticated attacker to perform internal network reconnaissance, interact with internal services (databases, admin panels, Kubernetes APIs), and access cloud instance metadata endpoints that may expose credentials or configuration secrets. The primary impact is high confidentiality loss on the vulnerable system, with a low integrity impact, as the attacker can read responses from internal services and potentially modify state via HTTP requests. In cloud-hosted or containerized deployments, access to the metadata endpoint (169.254.169.254) could enable privilege escalation or lateral movement by harvesting IAM credentials (GitHub Advisory, Budibase Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). Exploitation requires low privileges — any authenticated Budibase user who can create or modify automation workflows — and no user interaction beyond the attacker's own actions. No threat actor attribution, EPSS score, or CISA KEV catalog listing has been reported for this CVE.

1. Authenticate: Log in to a Budibase instance running @budibase/server < 3.41.3 with any account that has permission to create or edit automation workflows.
2. Create or edit an automation: Navigate to the Automations section and create a new automation or modify an existing one.
3. Add a vulnerable step: Add an automation step of type Outgoing Webhook, Zapier, n8n, Slack, or Discord.
4. Supply a malicious URL: In the URL field for the step, enter an internal target such as http://169.254.169.254/latest/meta-data/ (cloud metadata), http://10.0.0.1/admin (internal admin panel), or http://127.0.0.1:6379 (local Redis).
5. Trigger the automation: Run the automation manually or configure a trigger to fire it. The server will issue an HTTP request to the specified internal URL using node-fetch with no IP validation.
6. Retrieve the response: Depending on the automation configuration and response handling, the HTTP response body (e.g., IAM credentials, internal service data) may be returned to the attacker or logged, enabling further exploitation (GitHub Advisory, Budibase Advisory).

• Network: Outbound HTTP/HTTPS requests from the Budibase server process to RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.1), or the link-local metadata IP (169.254.169.254).
• Network: Unexpected connections from the Budibase server to internal service ports (e.g., 6379/Redis, 5432/PostgreSQL, 8080/admin panels, 6443/Kubernetes API).
• Logs: Budibase server logs showing automation step executions with URLs pointing to internal IP ranges or metadata endpoints.
• Logs: HTTP request logs recording calls to http://169.254.169.254/latest/meta-data/ or similar cloud metadata paths originating from the Budibase process.
• Process: Unusual outbound network activity from the Node.js process running @budibase/server, particularly to non-public IP ranges.

Upgrade @budibase/server to version 3.41.3 or later, which is the official patched release (Budibase Release). As an interim measure, configure the BLACKLIST_IPS environment variable with a comprehensive list of internal IP ranges (e.g., 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16) — note this only partially mitigates the issue for the REST API integration and does not protect automation steps until patched. Additionally, restrict automation workflow creation and modification permissions to trusted users only, and consider disabling automation features entirely if they are not required (GitHub Advisory).

The advisory was published by Budibase maintainer mjashanks on August 14, 2026, and reviewed the same day in the GitHub Advisory Database. No significant external researcher commentary, media coverage, or notable social media discussion has been identified beyond the advisory publication (GitHub Advisory).