VYPR
Vypr IntelligenceAI-generatedAug 28, 2026· 8 CVEs

Budibase: Critical RCE and Eight Other Flaws Disclosed Together on August 28, 2026

Eight vulnerabilities, including critical RCE and multiple SSRF and authorization bypasses, were disclosed for Budibase on August 28, 2026, all patched in version 3.41.3.

Key findings

On August 28, 2026, a batch of eight vulnerabilities was disclosed for Budibase, a low-code platform for building internal tools. The vulnerabilities, all patched in version 3.41.3, span critical and high severity ratings and include issues such as remote code execution, server-side request forgery (SSRF), and authorization bypasses. These flaws could allow attackers to gain unauthorized access, execute arbitrary code, or manipulate application data.

Several vulnerabilities revolve around Server-Side Request Forgery (SSRF). CVE-2026-82246 and CVE-2026-82243 highlight SSRF flaws in the query import and datasource verify endpoints, respectively. These allow authenticated users to submit arbitrary URLs, potentially leading to the retrieval of sensitive information from internal services or cloud metadata endpoints. Additionally, CVE-2026-82241 points to an SSRF vulnerability in the backend-core component due to an incomplete default blacklist of IP address ranges, which could be exploited in REST datasource query previews.

Authorization and role management were also compromised in multiple instances. CVE-2026-82245 describes a failure to enforce role-based authorization on license management endpoints, enabling any authenticated user to manipulate license keys and offline tokens. Similarly, CVE-2026-82240 details how app-scoped builder role assignments were not properly validated, allowing authenticated builders to grant elevated privileges to unrelated applications. CVE-2026-82239 is a critical authorization bypass where BASIC users can perform CRUD operations on any table, disregarding configured permissions, by exploiting the POST /api/datasources/query endpoint. CVE-2026-82242 also involves a missing authorization check on the POST /api/resources/duplicate endpoint, permitting authenticated builders to inject resources into any application.

A particularly severe vulnerability, CVE-2026-82244, presents a remote code execution (RCE) risk. This flaw in plugin handling allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server's use of eval() on plugin JavaScript files without proper sandboxing in the main Node.js process creates this RCE opportunity.

All eight vulnerabilities were addressed in Budibase version 3.41.3. Users are strongly advised to update to this version to mitigate the risks associated with SSRF, RCE, and authorization bypasses. The coordinated disclosure of these eight issues underscores the importance of timely patching for low-code platforms, which often handle sensitive data and internal system integrations.

The breadth of these vulnerabilities, from SSRF to RCE and privilege escalation, indicates a significant security posture concern for affected Budibase deployments. Promptly updating to version 3.41.3 is crucial for all users to protect their internal applications and data from potential compromise.

The disclosed vulnerabilities include:

All issues were resolved in Budibase version 3.41.3.

AI-written article. Grounded in 8 CVE records listed below.