CVE-2026-31818

Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist

State: Published
Severity: 9.6 Critical
Published: Apr 3, 2026
Updated: Apr 3, 2026
Reserved: Mar 9, 2026

Description

Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource connector. The platform's SSRF protection mechanism (IP blacklist) is rendered completely ineffective because the BLACKLIST_IPS environment variable is not set by default in any of the official deployment configurations. When this variable is empty, the blacklist function unconditionally returns false, allowing all requests through without restriction. This issue has been patched in version 3.33.4.

Scores

CVSS	Score	Vector	Source
3.1	9.6 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N	GitHub_M

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)
CWE-1188 Insecure Default Initialization of Resource

Affected Products

Product	Versions
budibaseBudibase	< 3.33.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.