CVE-2026-35219 Budibase CVE debrief

Who should care

Budibase administrators, security teams, and developers who use or manage Budibase deployments should assess their exposure to this vulnerability and prioritize verification and remediation efforts.

Why it matters

CVE-2026-35219 is a high-severity vulnerability in Budibase that allows authenticated users to make server-side requests to cloud metadata and internal services. Defenders should prioritize verifying exposure, assessing impact, and remediating vulnerable deployments.

• Authenticated users could potentially exploit this issue to make unauthorized server-side requests.
• Successful exploitation could lead to information disclosure or further compromise of internal services.
• Defenders should verify exposure and assess the impact on Budibase deployments, especially those with authenticated users.
• Remediation priority is high for Budibase deployments with publicly accessible authenticated user interfaces.

Technical summary

The Budibase platform, prior to version 3.41.3, is vulnerable to server-side request forgery (SSRF) attacks. This occurs because automation steps in certain files use node-fetch on user-provided URLs without the BLACKLIST_IPS enforcement used by the REST integration, allowing an authenticated user to make server-side requests to cloud metadata and internal services. Budibase administrators should assess their exposure to this vulnerability and prioritize verification and remediation efforts. The issue arises from automation steps in various files using node-fetch on user-provided URLs without the BLACKLIST_IPS enforcement used by the REST integration, which could lead to information disclosure or further  

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on Budibase deployments, especially those with authenticated users who could potentially exploit this issue.

Recommended defensive actions

• Verify if Budibase version 3.41.3 or later is deployed.
• Assess exposure of Budibase deployments to authenticated users who could potentially exploit this issue.
• Implement compensating controls, such as monitoring for suspicious server-side requests.
• Review and update incident response plans to address potential exploitation.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description and affected versions. However, the scope of affected deployments and potential impact on specific systems require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.