HIGH GitHub
CVE-2026-35219
Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist
## Summary
Budibase automation steps (outgoing webhook, Zapier, n8n, Slack, Discord, Make.com) make server-side HTTP requests to user-provided URLs using `node-fetch` directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist itself defaults to empty when `BLACKLIST_IPS` is not configured.
## Vulnerable Code
### Automation Steps (No Blacklist)
All automation steps use `fetch()` directly without any IP validation:
Affected Products
- npm/@budibase/server < 3.41.3
References
- https://github.com/advisories/GHSA-5fpj-28rv-84r7
- https://github.com/Budibase/budibase/security/advisories/GHSA-5fpj-28rv-84r7
- https://github.com/Budibase/budibase/releases/tag/3.41.3
- https://github.com/advisories/GHSA-5fpj-28rv-84r7
This high severity vulnerability was published on 2026-08-14 via GitHub. Affected: npm/@budibase/server < 3.41.3.
vulnfeed aggregates 10939 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.