{"id":"EUVD-2026-13879","enisaUuid":"5851b4a3-de7c-32e7-9ed4-ab2f428393c3","description":"Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions from 3.30.6 and prior, the REST datasource query preview endpoint (POST /api/queries/preview) makes server-side HTTP requests to any URL supplied by the user in fields.path with no validation. An authenticated admin can reach internal services that are not exposed to the internet — including cloud metadata endpoints (AWS/GCP/Azure), internal databases, Kubernetes APIs, and other pods on the internal network. On GCP this leads to OAuth2 token theft with cloud-platform scope (full GCP access). On any deployment it enables full internal network enumeration. At time of publication, there are no publicly available patches.","datePublished":"Mar 20, 2026, 11:04:24 PM","dateUpdated":"Mar 23, 2026, 4:48:16 PM","baseScore":8.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","references":"https://github.com/Budibase/budibase/security/advisories/GHSA-4647-wpjq-hh7f\n","aliases":"CVE-2026-33226\nGHSA-4647-wpjq-hh7f\n","assigner":"GitHub_M","epss":0.38,"enisaIdProduct":[{"id":"6cfcdde3-4d5a-3425-8c1e-56c41cab3f0e","product":{"name":"budibase","vendor":{"name":"budibase"}},"product_version":"≤ 3.30.6"}],"enisaIdVendor":[{"id":"f25027b9-2c78-36d8-8bf0-ca7d6eee546b","vendor":{"name":"budibase"}}],"enisaIdVulnerability":[{"id":"2cde9358-a815-305d-85f1-c2b06d1c65e4","vulnerability":{"id":"GHSA-4647-wpjq-hh7f","description":"Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview","datePublished":"Mar 18, 2026, 8:22:11 PM","dateUpdated":"Mar 25, 2026, 6:15:24 PM","baseScore":0.0,"references":"https://github.com/Budibase/budibase/security/advisories/GHSA-4647-wpjq-hh7f\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33226\nhttps://github.com/Budibase/budibase\n","enisa_id":"EUVD-2026-13879\n","aliases":"CVE-2026-33226\nGHSA-4647-wpjq-hh7f\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:46:27 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f508c7f1-108c-3df0-ad66-947c25c75b08","vulnerability":{"id":"CVE-2026-33226","description":"Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions from 3.30.6 and prior, the REST datasource query preview endpoint (POST /api/queries/preview) makes server-side HTTP requests to any URL supplied by the user in fields.path with no validation. An authenticated admin can reach internal services that are not exposed to the internet — including cloud metadata endpoints (AWS/GCP/Azure), internal databases, Kubernetes APIs, and other pods on the internal network. On GCP this leads to OAuth2 token theft with cloud-platform scope (full GCP access). On any deployment it enables full internal network enumeration. At time of publication, there are no publicly available patches.","datePublished":"Mar 20, 2026, 11:04:24 PM","dateUpdated":"Mar 23, 2026, 4:48:16 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","references":"https://github.com/Budibase/budibase/security/advisories/GHSA-4647-wpjq-hh7f\n","enisa_id":"EUVD-2026-13879\n","assigner":"GitHub_M","epss":0.38,"dataProcessed":"Nov 11, 2026, 7:23:33 AM","vulnerabilityProduct":[{"id":"c8dcdd22-4ec4-33e2-a372-1f36bc98db5c","product":{"name":"budibase","vendor":{"name":"budibase"}},"product_version":"≤ 3.30.6"}],"vulnerabilityVendor":[{"id":"81100dd7-83b2-389f-861f-62eef1e93dd2","vendor":{"name":"budibase"}}]}}],"enisaIdAdvisory":[]}