CVE-2026-31818: Critical SSRF in Budibase REST Connector

CVE-2026-31818 is a critical server side request forgery flaw (CVSS 9.6) in the REST datasource connector of Budibase before 3.33.4. The IP blacklist protection was ineffective because its variable is unset by default. Upgrade to Budibase 3.33.4.

What's affected

Budibase versions before 3.33.4 are affected. The patched version is 3.33.4.

The record says the BLACKLIST_IPS environment variable is not set by default in any of the official deployment configurations, and that an empty value makes the check allow every request.

How to check if you're exposed

Check your running version, for example from the image tags:

docker ps --format '{{.Names}} {{.Image}}'

Then look at your deployment files and environment for BLACKLIST_IPS. If it is missing or empty on a version before 3.33.4, the protection did nothing.

What to do now

1. Upgrade Budibase to 3.33.4 or later.
2. Read the release notes and advisory for how the setting behaves in the fixed version, and review your environment configuration.
3. Limit outbound network access from the Budibase server so it cannot reach internal services or cloud metadata addresses it does not need.
4. Limit who can create REST datasources, since the feature sends requests from the server.

Why it matters

The weaknesses are CWE-918, server side request forgery, and CWE-1188, insecure default initialization of a resource. The control existed, but it shipped switched off. A safeguard that needs an administrator to turn it on gives no protection to anyone who does not know to.

Server side requests can reach internal systems that outside users cannot. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Budibase security advisory GHSA-7r9j-r86q-7g45
• Budibase 3.33.4 release
• NVD record for CVE-2026-31818

Last reviewed: 19 October 2026.