CVE-2026-31818

critical · 9.6

Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource connector. The platform's SSRF protection mechanism (IP blacklist) is rendered completely ineffective because the BLACKLIST_IPS environment variable is not set by default in any of the official deployment configurations. When this variable is empty, the blacklist function unconditionally returns false, allowing all requests through without restriction. This issue has been patched in version 3.33.4.

9.6

CVSS

0.4%

EPSS (exploit prob.)

32nd

EPSS percentile

2026-04-03

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Weaknesses

CWE-918CWE-1188

Affected products

Vendor	Product	Affected versions
budibase	budibase	< 3.33.4

Check a specific version with /api/v1/cve/match.

References

https://github.com/Budibase/budibase/commit/5b0fe83d4ece52696b62589cba89ef50cc009732
https://github.com/Budibase/budibase/pull/18236
https://github.com/Budibase/budibase/releases/tag/3.33.4
https://github.com/Budibase/budibase/security/advisories/GHSA-7r9j-r86q-7g45

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-31818