CVE-2026-82241 affects Budibase's backend-core package (@budibase/backend-core), which omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist (DEFAULT_BLACKLIST). This omission applies to self-hosted deployments that have not defined a custom BLACKLIST_IPS environment variable. An authenticated user with Builder-level permissions can exploit this by submitting a REST datasource query preview request via POST /api/queries/preview targeting an HTTP(S) service within the 100.64.0.0/10 range. The server will then send a request to that target and return the response to the attacker through the preview flow. No official patch had been released at the time of publication. The recommended remediation is to manually add 100.64.0.0/10 to the DEFAULT_BLACKLIST. This vulnerability poses a risk primarily in self-hosted Budibase environments where internal or carrier-grade NAT services may be reachable within the omitted IP range.