CVE-2026-82246: falha de alta gravidade em budibase server
Budibase Server before 3.41.3 SSRF via Query Import
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.2%
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints and other restricted network resources.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
budibase · serverCVEs relacionadas — budibase server
No mesmo produto, das mais perigosas para as menos.
CVE-2026-82244CRITICALBudibase before 3.41.3 Remote Code Execution via Plugin eval()EPSS 0.9%CVE-2026-100682HIGHBudibase Server before 3.45.0 Arbitrary File Write via ZIP SymlinkEPSS 0.7%CVE-2026-72850CRITICALBudibase before 3.40.0 Arbitrary File Write via Path TraversalEPSS 0.5%CVE-2026-100684CRITICALBudibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDCEPSS 0.4%CVE-2026-82245HIGHBudibase before 3.41.3 Missing Authorization License ManagementEPSS 0.4%CVE-2026-72855HIGHBudibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and RESTEPSS 0.4%