PT-2026-30188 · Budibase · Budibase

Moonster8282 · Published 2026-04-03 · Updated 2026-04-04 · CVE-2026-31818

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

**Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.33.4

**Description Budibase, an open-source low-code platform, contains a server-side request forgery (SSRF) vulnerability in its REST datasource connector. The platform's SSRF protection is ineffective because the BLACKLIST IPS environment variable is not set by default in official deployment configurations. When this variable is empty, the blacklist function always returns false, allowing unrestricted requests. This allows access to internal services.

**Recommendations Update Budibase to version 3.33.4 or later.

Fix

SSRF

Weakness Enumeration

CWE-1188

CWE-918

Related Identifiers

CVE-2026-31818

GHSA-7R9J-R86Q-7G45

Affected Products

Budibase

References · 12

• https://github.com/Budibase/budibase/commit/5b0fe83d4ece52696b62589cba89ef50cc009732 · Patch
• https://github.com/Budibase/budibase/security/advisories/GHSA-7r9j-r86q-7g45 · Vendor Advisory
• https://github.com/Budibase/budibase/pull/18236 · Patch
• https://osv.dev/vulnerability/GHSA-7r9j-r86q-7g45 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31818 · Security Note
• https://github.com/Budibase/budibase · Note
• https://github.com/Budibase/budibase/releases/tag/3.33.4 · Note
• https://twitter.com/CveFindCom/status/2040122986699632982 · Twitter Post
• https://twitter.com/0dayPublishing/status/2040095595881255363 · Twitter Post
• https://twitter.com/pulsepatchio/status/2040440983133855925 · Twitter Post
• https://twitter.com/CVEnew/status/2040111820388851785 · Twitter Post
• https://twitter.com/TheHackerWire/status/2040338565994107241 · Twitter Post