CVE-2026-31818

critical

Budibase is an open-source low-code platform.

Vendor / product: Budibase — budibase

Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource connector. The platform's SSRF protection mechanism (IP blacklist) is rendered completely ineffective because the BLACKLIST_IPS environment variable is not set by default in any of the official deployment configurations. When this variable is empty, the blacklist function unconditionally returns false, allowing all requests through without restriction. This issue has been patched in version 3.33.4.

CVSS

9.9

9.9 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2026-04-03 16:16

Modified: 2026-10-06 22:10

NVD status: Analyzed

Last synced 3 days ago

Verified against the source API 2026-10-27 07:07 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

budibase / budibase <3.33.4

Weakness classification (CWE)

CWE-918 CWE-1188

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/Budibase/budibase/security/advisories/GHSA-7r9j-r86q-7g45

Patch / mitigation: https://github.com/Budibase/budibase/commit/5b0fe83d4ece52696b62589cba89ef50cc009732

Patch / mitigation: https://github.com/Budibase/budibase/pull/18236

Patch / mitigation: https://github.com/Budibase/budibase/security/advisories/GHSA-7r9j-r86q-7g45

References

https://github.com/Budibase/budibase/commit/5b0fe83d4ece52696b62589cba89ef50cc009732 security-advisories@github.com
https://github.com/Budibase/budibase/pull/18236 security-advisories@github.com
https://github.com/Budibase/budibase/releases/tag/3.33.4 security-advisories@github.com
https://github.com/Budibase/budibase/security/advisories/GHSA-7r9j-r86q-7g45 security-advisories@github.com

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores