CVE-2026-31818

Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource connector. The platform's SSRF protection mechanism (IP blacklist) is rendered completely ineffective because the BLACKLIST_IPS environment variable is not set by default in any of the official deployment configurations. When this variable is empty, the blacklist function unconditionally returns false, allowing all requests through without restriction. This issue has been patched in version 3.33.4.

• CWE-918
• CWE-1188

• https://github.com/Budibase/budibase/commit/5b0fe83d4ece52696b62589cba89ef50cc009732Patch
• https://github.com/Budibase/budibase/pull/18236Issue Tracking, Patch
• https://github.com/Budibase/budibase/releases/tag/3.33.4Product, Release Notes
• https://github.com/Budibase/budibase/security/advisories/GHSA-7r9j-r86q-7g45Exploit, Mitigation, Vendor Advisory

Published

Apr 3, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-31812Quinn is a pure-Rust, async-compatible implementation of the…8.7
• CVE-2026-31813Supabase Auth is a JWT based API for managing users and issu…4.8
• CVE-2026-31814Yamux is a stream multiplexer over reliable, ordered connect…7.5
• CVE-2026-31815Unicorn adds modern reactive component functionality to your…5.3
• CVE-2026-31816Budibase is a low code platform for creating internal tools,…9.1
• CVE-2026-31817OliveTin gives access to predefined shell commands from a we…8.5
• CVE-2026-31819Sylius is an Open Source eCommerce Framework on Symfony. Cur…6.1
• CVE-2026-3182Zohocorp ManageEngine Endpoint Central versions before 11.4.…4.3
• CVE-2026-31820Sylius is an Open Source eCommerce Framework on Symfony. An …6.5
• CVE-2026-31821Sylius is an Open Source eCommerce Framework on Symfony. The…5.3
• CVE-2026-31822Sylius is an Open Source eCommerce Framework on Symfony. A c…6.1
• CVE-2026-31823Sylius is an Open Source eCommerce Framework on Symfony. An …4.8