CVE-2026-33226

🗓️ 20 Mar 2026 23:04:24Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 49 Views🌐 WEB

CVE-2026-33226: Authenticated admins can abuse Budibase preview to access internal services via user URL, enabling token theft and internal network enumeration.

Reporter	Title	Published	Views	Family All 14
attackerkb	CVE-2026-33226	20 Mar 202623:04	–	attackerkb
Circl	CVE-2026-33226	18 Mar 202611:02	–	circl
CNNVD	Budibase code issues and vulnerabilities	20 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-33226 Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview	20 Mar 202623:04	–	cvelist
Github Security Blog	Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview	18 Mar 202620:22	–	github
Mend	CVE-2026-33226	20 Mar 202623:04	–	mend
NVD	CVE-2026-33226	20 Mar 202623:16	–	nvd
osv_ghsa	GHSA-4647-WPJQ-HH7F Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview	18 Mar 202620:22	–	osv_ghsa
Positive Technologies	PT-2026-26216	18 Mar 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-33226: Server-Side Request Forgery (SSRF)	20 Mar 202600:00	–	rapid7

NVD

Vulners

Node

budibase budibaseRange≤3.30.6

[
  {
    "vendor": "Budibase",
    "product": "budibase",
    "versions": [
      {
        "version": "<= 3.30.6",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/Budibase/budibase/security/advisories/GHSA-4647-wpjq-hh7f

Parameter	Position	Path	Description	CWE
fields.path	request body	/api/queries/preview	The REST datasource query preview endpoint makes server-side HTTP requests to any URL supplied by the user in the fields.path field without validation, leading to SSRF.	CWE-918

07 Oct 2026 08:10Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.18.7

EPSS0.00415

SSVC

CWE-918