CVE-2026-31818 - Vulnerability Analysis

Overview

Budibase < 3.33.4 contains a server-side request forgery caused by an ineffective IP blacklist in the REST datasource connector, letting attackers make unrestricted requests, exploit requires network access.

Severity & Score

Impact

Attackers can make arbitrary server-side requests, potentially accessing internal resources or services.

Mitigation

Update to version 3.33.4 or later.

References

• https://github.com/Budibase/budibase/commit/5b0fe83d4ece52696b62589cba89ef50cc009732
• https://github.com/Budibase/budibase/pull/18236
• https://github.com/Budibase/budibase/releases/tag/3.33.4
• https://github.com/Budibase/budibase/security/advisories/GHSA-7r9j-r86q-7g45

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 4, 2026

🔴 CVE-2026-31818 - Critical (9.6) Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource connector. The platform's SSRF protection mechanism (IP blacklist) is rendered completel... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31818/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner