{"apiVersion":"1.0","identifier":"CVE-2026-82246","description":"Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints and other restricted network resources.","publishedAt":"2026-08-28T12:16:36","lastModifiedAt":"2026-08-28T16:18:32","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82246","cvssScore":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","epssProbability":0,"riskScore":0.71,"affectedProduct":"Budibase","affectedVersions":"<3.41.3","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-82246","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-82246","en":"https://www.redsauce.net/en/cves/CVE-2026-82246","fr":"https://www.redsauce.net/fr/cves/CVE-2026-82246","pt":"https://www.redsauce.net/pt/cves/CVE-2026-82246","de":"https://www.redsauce.net/de/cves/CVE-2026-82246","sk":"https://www.redsauce.net/sk/cves/CVE-2026-82246","el":"https://www.redsauce.net/el/cves/CVE-2026-82246"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-82246"}}