AI Threat Alert
CVE-2026-35219
HIGHBudibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and...
Full CISO analysis pending enrichment.
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| budibase | — | — | No patch |
Do you use budibase? You're affected.
How severe is it?
What should I do?
No patch available
Monitor for updates. Consider compensating controls or temporary mitigations.
Which compliance frameworks are affected?
Compliance analysis pending. Sign in for full compliance mapping when available.
Frequently Asked Questions
What is CVE-2026-35219?
Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and packages/server/src/automations/steps/discord.ts use node-fetch on user-provided URLs without the BLACKLIST_IPS enforcement used by the REST integration, allowing an authenticated user to make server-side requests to cloud metadata and internal services. This issue is fixed in version 3.41.3.
Is CVE-2026-35219 actively exploited?
No confirmed active exploitation of CVE-2026-35219 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-35219?
No patch is currently available. Monitor vendor advisories for updates.
What is the CVSS score for CVE-2026-35219?
No CVSS score has been assigned yet.
What are the technical details?
Original Advisory
Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and packages/server/src/automations/steps/discord.ts use node-fetch on user-provided URLs without the BLACKLIST_IPS enforcement used by the REST integration, allowing an authenticated user to make server-side requests to cloud metadata and internal services. This issue is fixed in version 3.41.3.
Weaknesses (CWE)
CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Source: MITRE CWE corpus.
References
- github.com/Budibase/budibase/commit/cc07563a6b0fc0f91c51aae295952b1295546a90 x_refsource_MISC
- github.com/Budibase/budibase/pull/19328 x_refsource_MISC
- github.com/Budibase/budibase/releases/tag/3.41.3 x_refsource_MISC
- github.com/Budibase/budibase/security/advisories/GHSA-5fpj-28rv-84r7 x_refsource_CONFIRM