Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist (DEFAULT_BLACKLIST) used by REST datasource query previews. When the default blacklist is active (i.e., a self-hosted deployment has not defined BLACKLIST_IPS), an authenticated user with the Builder permission can submit a REST datasource query preview request to POST /api/queries/preview targeting a reachable HTTP(S) service in the 100.64.0.0/10 range, causing the server to send a request to that target and return its response through the preview flow. Per the advisory, no released fix was identified at the time of publication; remediation is to add 100.64.0.0/10 to DEFAULT_BLACKLIST.

CVE-2026-82241 affects Budibase's backend-core package (@budibase/backend-core), which omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist (DEFAULT_BLACKLIST). This omission applies to self-hosted deployments that have not defined a custom BLACKLIST_IPS environment variable. An authenticated user with Builder-level permissions can exploit this by submitting a REST datasource query preview request via POST /api/queries/preview targeting an HTTP(S) service within the 100.64.0.0/10 range. The server will then send a request to that target and return the response to the attacker through the preview flow. No official patch had been released at the time of publication. The recommended remediation is to manually add 100.64.0.0/10 to the DEFAULT_BLACKLIST. This vulnerability poses a risk primarily in self-hosted Budibase environments where internal or carrier-grade NAT services may be reachable within the omitted IP range.