Server-Side Request Forgery Vulnerability in Budibase Low-Code Platform
CVE-2026-31818

9.6CRITICAL

Key Information:

Vendor: Budibase
Status: Budibase
Vendor: CVE Published:; 3 April 2026

What is CVE-2026-31818?

Budibase, an open-source low-code platform, has a vulnerability in its REST datasource connector that allows for server-side request forgery (SSRF). The lack of a default setting for the BLACKLIST_IPS environment variable means that the platform's SSRF protection mechanism fails, allowing unrestricted requests. This issue has been resolved in version 3.33.4, where the necessary security measures were implemented.