CVE-2026-31818

CRITICAL SEVERITY

CVSS Score & Metrics

Base Score

9.6 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N                                    

Vulnerability Description

Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource connector. The platform's SSRF protection mechanism (IP blacklist) is rendered completely ineffective because the BLACKLIST_IPS environment variable is not set by default in any of the official deployment configurations. When this variable is empty, the blacklist function unconditionally returns false, allowing all requests through without restriction. This issue has been patched in version 3.33.4.

Vulnerability Details

Published Date

April 03, 2026

Last Modified

April 08, 2026

CWE ID

CWE-918

Source

NVD

Vendor

Budibase

Product

budibase

External References

https://github.com/Budibase/budibase/commit/5b0fe83d4ece52696b62589cba89ef50cc009732
https://github.com/Budibase/budibase/pull/18236
https://github.com/Budibase/budibase/releases/tag/3.33.4
https://github.com/Budibase/budibase/security/advisories/GHSA-7r9j-r86q-7g45

CVE-2026-31818

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment