Critical severity9.6NVD Advisory· Published Apr 3, 2026· Updated Apr 8, 2026
CVE-2026-31818
CVE-2026-31818
Description
Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource connector. The platform's SSRF protection mechanism (IP blacklist) is rendered completely ineffective because the BLACKLIST_IPS environment variable is not set by default in any of the official deployment configurations. When this variable is empty, the blacklist function unconditionally returns false, allowing all requests through without restriction. This issue has been patched in version 3.33.4.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@budibase/backend-corenpm | < 3.33.4 | 3.33.4 |
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/Budibase/budibase/commit/5b0fe83d4ece52696b62589cba89ef50cc009732nvdPatchWEB
- github.com/Budibase/budibase/pull/18236nvdIssue TrackingPatchWEB
- github.com/Budibase/budibase/security/advisories/GHSA-7r9j-r86q-7g45nvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-7r9j-r86q-7g45ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-31818ghsaADVISORY
- github.com/Budibase/budibase/releases/tag/3.33.4nvdProductRelease NotesWEB
News mentions
0No linked articles in our index yet.