CVE-2026-33226 - Vulnerability Analysis

Overview

Budibase <= 3.30.6 contains a server-side request forgery caused by lack of validation in REST datasource query preview endpoint, letting authenticated admins access internal services and cloud metadata, exploit requires admin authentication.

Severity & Score

Impact

Authenticated admins can access internal services and cloud metadata, leading to full internal network enumeration and potential OAuth2 token theft on GCP.

Mitigation

Update to the latest version once patches are available.

References

• https://github.com/Budibase/budibase/security/advisories/GHSA-4647-wpjq-hh7f

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner