CVE-2026-82241: Server-Side Request Forgery (SSRF)

Budibase backend-core @budibase/backend-core, as used by @budibase/server omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist DEFAULTBLACKLIST used by REST datasource query previews. When the default blacklist is active i.e., a self-hosted deployment has not defined...

CVE-2026-82243: Server-Side Request Forgery (SSRF)

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to...

PT-2026-83093

Budibase backend-core @budibase/backend-core, as used by @budibase/server omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist DEFAULT BLACKLIST used by REST datasource query previews. When the default blacklist is active i.e., a self-hosted deployment has not define...

PT-2026-83095

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to...

clickhouse-datasource silently drops TLS over PDC

When the ClickHouse plugin uses Native protocol the default with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never...

Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

Summary Budibase 3.39.7 allows a low-privilege authenticated published-app user with the built-in BASIC role to obtain arbitrary S3 pre-signed upload URLs backed by a workspace datasource's stored server-side credentials. The affected endpoint is: POST /api/attachments/:datasourceId/url The calle...

GHSA-6X9P-4R67-5GJX Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

Summary Budibase 3.39.7 allows a low-privilege authenticated published-app user with the built-in BASIC role to obtain arbitrary S3 pre-signed upload URLs backed by a workspace datasource's stored server-side credentials. The affected endpoint is: POST /api/attachments/:datasourceId/url The calle...

BIT-GRAFANA-2026-17183 CVE-2026-17183 CVE Record

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID incorrect authorization. This can expose data accessible through Grafana's configured...

Grafana Alerting: Datasource query authorization bypass via spoofed queryType

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID incorrect authorization. This can expose data accessible through Grafana’s configured...

SUSE CVE-2026-17183

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID incorrect authorization. This can expose data accessible through Grafana's configured...

Linux Distros Unpatched Vulnerability : CVE-2026-17183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side...

CVE-2026-17183

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID incorrect authorization. This can expose data accessible through Grafana's configured...

CVE-2026-17183 CVE-2026-17183 CVE Record

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID incorrect authorization. This can expose data accessible through Grafana's configured...

EUVD-2026-62597

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID incorrect authorization. This can expose data accessible through Grafana's configured...

CVE-2026-17183

In Grafana OSS (confirmed 13.0.1), the Unified Alerting/ngalert component skips datasource authorization when queryType equals __expr__, but execution uses the real datasourceUid. An authenticated low-privileged user can set queryType: "__expr__" with a real datasource UID to bypass datasources:q...

CVE-2026-17183 CVE-2026-17183 CVE Record

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID incorrect authorization. This can expose data accessible through Grafana's configured...

PT-2026-78541

Name of the Vulnerable Software and Affected Versions Grafana OSS version 13.0.1 Description An authenticated low-privileged user with permissions to create or edit alert rules in a folder can bypass datasource permission enforcement. By setting the client-controlled queryType variable to expr...

CVE-2026-73410

Budibase versions prior to 3.40.0 have a DNS-rebinding SSRF flaw in the REST datasource integration. The guard fetchWithBlacklist pins a validated IP via a Node http(s).Agent, but rest.ts routes requests through undici's fetch, which silently ignores the agent option and uses its own dispatcher t...

CVE-2026-73410 Budibase: SSRF via DNS rebinding in the REST datasource integration

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resol...

CVE-2026-73410 Budibase: SSRF via DNS rebinding in the REST datasource integration

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resol...