CVE-2026-31818
published 2026-04-03CVE-2026-31818: Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource…
PriorityP262critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAL
EPSS
0.38%
29.5th percentile
Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource connector. The platform's SSRF protection mechanism (IP blacklist) is rendered completely ineffective because the BLACKLIST_IPS environment variable is not set by default in any of the official deployment configurations. When this variable is empty, the blacklist function unconditionally returns false, allowing all requests through without restriction. This issue has been patched in version 3.33.4.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| budibase | backend-core | >= 0 < 3.33.4 | 3.33.4 |
| budibase | budibase | < 3.33.4 | 3.33.4 |
| budibase | server | >= 0 < 3.38.1 | 3.38.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters
ghsa·2026-05-15
CVE-2026-45717 [HIGH] CWE-862 Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters
Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL
## Summary
Budibase exposes a REST API for datasource management. The route `PUT /api/datasources/:datasourceId` is registered in the `authorizedRoutes` group with `TABLE/READ` permission. This is the same authorization level as the read endpoint (`GET /api/datasources/:datasourceId`). Every authenticated Budibase app user with the `BASIC` built-in role or higher carries `TABLE/WRITE` (and therefore `TABLE/READ`) permissions, and the datasource update controller performs no additional builder check.
As a result, any authenticated non-builder app user can submi
OSV
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
osv·2026-04-03
CVE-2026-31818 [CRITICAL] Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
## 1. Summary
| Field | Value |
|-------|-------|
| **Title** | SSRF via REST Connector with Empty Default Blacklist Leading to Full Internal Data Exfiltration |
| **Product** | Budibase |
| **Version** | 3.30.6 (latest stable as of 2026-02-25) |
| **Component** | REST Datasource Integration + Backend-Core Blacklist Module |
| **Severity** | Critical |
| **Attack Vector** | Network |
| **Privileges Required** | Low (Builder role, or QUERY WRITE for execution of pre-existing queries) |
| **User Interaction** | None |
| **Affected Deployments** | All self-hosted instances without explicit `BLACKLIST_IPS` configuration (believed to be the vast majority) |
---
## 2. Description
A critical Server-Side Req
GHSA
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
ghsa·2026-04-03
CVE-2026-31818 [CRITICAL] CWE-1188 Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
## 1. Summary
| Field | Value |
|-------|-------|
| **Title** | SSRF via REST Connector with Empty Default Blacklist Leading to Full Internal Data Exfiltration |
| **Product** | Budibase |
| **Version** | 3.30.6 (latest stable as of 2026-02-25) |
| **Component** | REST Datasource Integration + Backend-Core Blacklist Module |
| **Severity** | Critical |
| **Attack Vector** | Network |
| **Privileges Required** | Low (Builder role, or QUERY WRITE for execution of pre-existing queries) |
| **User Interaction** | None |
| **Affected Deployments** | All self-hosted instances without explicit `BLACKLIST_IPS` configuration (believed to be the vast majority) |
---
## 2. Description
A critical Server-Side Req
No detection rules found.
No public exploits indexed.
2026-04-03
Published