EUVD-2026-18792
GHSA-7r9j-r86q-7g45
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Lifecycle Timeline
6DescriptionNVD
Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource connector. The platform's SSRF protection mechanism (IP blacklist) is rendered completely ineffective because the BLACKLIST_IPS environment variable is not set by default in any of the official deployment configurations. When this variable is empty, the blacklist function unconditionally returns false, allowing all requests through without restriction. This issue has been patched in version 3.33.4.
AnalysisAI
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticated users with low privileges to bypass IP blacklist protections and access internal network resources. The vulnerability stems from a configuration flaw where the BLACKLIST_IPS environment variable is not set by default in official deployments, causing all blacklist checks to fail silently. With CVSS 9.6 (Critical) due to scope change and high confidentiality/integrity impact, this represents a significant risk for organizations using Budibase in cloud or containerized environments. No active exploitation confirmed (not in CISA KEV), but publicly available exploit code exists via the patch disclosure.
Technical ContextAI
Budibase is an open-source low-code application platform with a REST datasource connector that allows integration with external APIs. This vulnerability (CWE-918: Server-Side Request Forgery) exists in the SSRF protection implementation within the REST connector component. The security mechanism relies on an IP blacklist to prevent requests to internal/private network ranges, but the validation logic contains a critical flaw: when the BLACKLIST_IPS environment variable is empty or undefined, the blacklist validation function returns false unconditionally, effectively disabling all SSRF protections. This is a configuration-as-code security failure where the absence of explicit configuration creates an insecure-by-default state. The CVSS vector indicates network-based exploitation with low attack complexity, low privilege requirements (PR:L), and scope change (S:C), meaning an authenticated attacker can pivot from the Budibase application context to access other network resources beyond the application's intended security boundary.
RemediationAI
Vendor-released patch: Budibase version 3.33.4. Organizations should immediately upgrade to version 3.33.4 or later, available at https://github.com/Budibase/budibase/releases/tag/3.33.4. The fix (commit 5b0fe83d4ece52696b62589cba89ef50cc009732, PR #18236) implements secure-by-default IP blacklist configuration and repairs the validation logic. For environments unable to upgrade immediately, implement network-level egress controls to restrict Budibase server outbound connections to only necessary external endpoints, and explicitly configure the BLACKLIST_IPS environment variable to include private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16, and cloud metadata endpoints like 169.254.169.254). Verify that REST datasource connectors cannot reach internal infrastructure through testing. Review access logs for any suspicious REST connector activity targeting internal IP ranges prior to patching.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an
Authentication bypass in Budibase low-code platform (versions prior to 3.35.4) allows remote unauthenticated attackers t
Remote code execution in Budibase versions prior to 3.33.4 allows unauthenticated attackers to execute arbitrary Bash co
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today