VYPR
← All advisories
Medium severity6.8OSV Advisory· Published Aug 1, 2026· Updated Aug 31, 2026

CVE-2026-67311

CVE-2026-67311

Description

Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to internal IP addresses, bypassing blacklist protection to access cloud metadata endpoints and internal services.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Budibase/BudibaseOSV2 versions
    3.34.3, 3.38.0, 3.37.5, …+ 1 more
    • (no CPE)range: 3.34.3, 3.38.0, 3.37.5, …
    • (no CPE)range: <3.38.1

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.