CVE-2026-31818

Name: CVE-2026-31818
Creator: NVD / NIST
Published: 2026-04-03T16:16:39.8+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.9/10EPSS 0.38%

Last modified Jun 17, 2026

CVE-2026-31818 is a critical-severity vulnerability rated 9.9/10 on the CVSS scale. Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource connector. EPSS estimates a 0.38% chance of exploitation in the next 30 days.

Description

Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource connector. The platform's SSRF protection mechanism (IP blacklist) is rendered completely ineffective because the BLACKLIST_IPS environment variable is not set by default in any of the official deployment configurations. When this variable is empty, the blacklist function unconditionally returns false, allowing all requests through without restriction. This issue has been patched in version 3.33.4.

Metrics

CVSS 3.1

9.9/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

EPSS Probability

0.38%

29.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Budibase	Budibase	< 3.33.4

References

https://github.com/Budibase/budibase/commit/5b0fe83d4ece52696b62589cba89ef50cc009732Patch
https://github.com/Budibase/budibase/pull/18236Issue Tracking, Patch
https://github.com/Budibase/budibase/releases/tag/3.33.4Product, Release Notes
https://github.com/Budibase/budibase/security/advisories/GHSA-7r9j-r86q-7g45Exploit, Mitigation, Vendor Advisory

Timeline

Published: Apr 3, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2026-31818?

How severe is CVE-2026-31818?

CVE-2026-31818 has a CVSS score of 9.9/10 (CRITICAL severity). The EPSS model estimates a 0.38% probability of exploitation in the next 30 days.

How do I fix CVE-2026-31818?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-31818?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST