An authenticated administrator can exploit a server-side request forgery vulnerability in Budibase to gain unauthorized access to internal network resources and cloud metadata services.

This is a server-side request forgery (SSRF) flaw occurring in the REST datasource query preview endpoint (POST /api/queries/preview). An authenticated administrator can bypass network restrictions to send requests to internal services, such as Kubernetes APIs or cloud metadata endpoints, because the application fails to validate user-supplied URLs.

The exploitation of this vulnerability poses a severe risk to organizational infrastructure by facilitating unauthorized access to sensitive internal environments. Successful attacks can result in the compromise of cloud environment credentials, such as OAuth2 tokens, and permit full internal network enumeration, which significantly increases the risk of lateral movement and data exfiltration. The CVSS score of 8.7 reflects the high impact on confidentiality and integrity, despite requiring administrative authentication.

Immediate Action: As no official patch is currently available, administrators should restrict access to the Budibase administrative interface to only trusted, hardened workstations and monitor for unauthorized egress traffic.

Proactive Monitoring: Security teams should implement egress filtering on the host running the Budibase instance to block requests to sensitive metadata IP addresses like 169.254.169.254.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an API gateway to inspect and sanitize requests to the /api/queries/preview endpoint, specifically blocking attempts to access internal network ranges.

Public Exploit Available: Unknown.

Given the lack of an available patch, organizations must treat this vulnerability with high priority by implementing strict network segmentation and egress controls around the Budibase application. Administrators should actively monitor vendor release notes and apply the necessary security updates immediately upon their availability to close this critical exposure.