Critical severity · published Apr 3, 2026
CVE-2026-31818
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
9.9
CVSS
0.4%
EPSS
No
On KEV
Description
Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource connector. The platform's SSRF protection mechanism (IP blacklist) is rendered completely ineffective because the BLACKLIST_IPS environment variable is not set by default in any of the official deployment configurations. When this variable is empty, the blacklist function unconditionally returns false, allowing all requests through without restriction. This issue has been patched in version 3.33.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BU
budibase · Budibase
< 3.33.4 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-31818
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-31818
Patch
https://github.com/Budibase/budibase/commit/5b0fe83d4ece52696b62589cba89ef50cc009732
Issue Tracking
https://github.com/Budibase/budibase/pull/18236
Product
https://github.com/Budibase/budibase/releases/tag/3.33.4
Exploit
https://github.com/Budibase/budibase/security/advisories/GHSA-7r9j-r86q-7g45
More from budibase
9.9
CVE-2026-46425
Budibase: SCIM endpoints lack role-based authorization, BASIC users CRUD tenant users
9.8
CVE-2026-54350
Budibase: Anonymous NoSQL operator injection via published-app query templates
9.6
CVE-2026-73300
Budibase: SQL Injection via `multipleStatements: true`
9.6
CVE-2026-54351
Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override
9.6
CVE-2026-54352
Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload