{"id":"EUVD-2026-13879","revision":"84590d271c19450996929bb19259b507","records":[{"revision":"84590d271c19450996929bb19259b507","observedAt":"2026-11-01T05:12:37.73+00:00","statement":{"source":"euvd","id":"EUVD-2026-13879","aliases":["CVE-2026-33226","GHSA-4647-wpjq-hh7f"],"title":"Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions from 3.30.6 and prior, the REST datasource query preview endpoint (POST /api/queries/preview) makes server-side HTTP requests to any URL s…","description":"Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions from 3.30.6 and prior, the REST datasource query preview endpoint (POST /api/queries/preview) makes server-side HTTP requests to any URL supplied by the user in fields.path with no validation. An authenticated admin can reach internal services that are not exposed to the internet — including cloud metadata endpoints (AWS/GCP/Azure), internal databases, Kubernetes APIs, and other pods on the internal network. On GCP this leads to OAuth2 token theft with cloud-platform scope (full GCP access). On any deployment it enables full internal network enumeration. At time of publication, there are no publicly available patches.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","score":8.7,"severity":null}],"references":["https://github.com/Budibase/budibase/security/advisories/GHSA-4647-wpjq-hh7f"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-13879","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Mar 20, 2026, 11:04:24 PM","dateUpdated":"Mar 23, 2026, 4:48:16 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-13879","identifiers":["EUVD-2026-13879","CVE-2026-33226","GHSA-4647-wpjq-hh7f"]},"retained":false,"historicalAffected":[]}],"coverage":[]}