CVE-2026-31818 | THREATINT

Description

Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource connector. The platform's SSRF protection mechanism (IP blacklist) is rendered completely ineffective because the BLACKLIST_IPS environment variable is not set by default in any of the official deployment configurations. When this variable is empty, the blacklist function unconditionally returns false, allowing all requests through without restriction. This issue has been patched in version 3.33.4.

PUBLISHED Reserved 2026-03-09 | Published 2026-04-03 | Updated 2026-04-03 | Assigner GitHub_M

CRITICAL: 9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Problem types

CWE-918: Server-Side Request Forgery (SSRF)

CWE-1188: Insecure Default Initialization of Resource

Product status

< 3.33.4

affected

References

github.com/...dibase/security/advisories/GHSA-7r9j-r86q-7g45

github.com/Budibase/budibase/pull/18236

github.com/...ommit/5b0fe83d4ece52696b62589cba89ef50cc009732

github.com/Budibase/budibase/releases/tag/3.33.4

cve.org (CVE-2026-31818)

nvd.nist.gov (CVE-2026-31818)

Download JSON