# CVE-2026-31818: Budibase SSRF in REST datasource connector

Source: https://junglewise.ai/threats/cve-2026-31818-budibase-ssrf-in-rest-datasource-connector  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-31818 · Severity: critical · CVSS 9.6 · Published 2026-04-03

Budibase is a low-code platform used by businesses to build internal applications and connect to various data sources. A security flaw in its REST connector allowed users to bypass intended network restrictions and access sensitive internal systems or data that should have been private. This could lead to unauthorized access to internal databases, cloud metadata services, or other corporate infrastructure.

Technologies: [@budibase/backend-core (npm)](https://junglewise.ai/threats/technologies/budibase-backend-core). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-31818 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-31818 being exploited in the wild.

**How severe is CVE-2026-31818?** Critical severity, with a CVSS score of 9.6, published 3 April 2026.

**Which products and versions are affected?** @budibase/backend-core (npm) SEMVER:introduced=0,fixed=3.33.4.

**Is there a fix for CVE-2026-31818?** Yes. @budibase/backend-core (npm): upgrade to 3.33.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-31818 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-31818?** Check whether you run @budibase/backend-core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @budibase/backend-core (npm): upgrade to 3.33.4 or later

  ```sh
  npm install @budibase/backend-core@3.33.4
  ```


## Technical details

A server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource connector because the platform's IP blacklist protection was rendered ineffective by default. The protection mechanism relied on the 'BLACKLIST_IPS' environment variable, which was not populated in official deployment configurations; when empty, the validation function would unconditionally permit all requests. An authenticated attacker with permissions to configure REST datasources could exploit this to probe or interact with internal network resources, loopback interfaces, and cloud metadata endpoints (e.g., IMDS). The fix in version 3.33.4 introduces a hardcoded default blacklist covering common private and link-local IPv4/IPv6 ranges and implements a fail-closed approach for DNS resolution and URL parsing errors.

## Affected products

- Budibase Budibase < 3.33.4

## Identifiers

- CVE-2026-31818
- GHSA-7r9j-r86q-7g45

## Timeline

- 2026-03-13: patched: Fix merged and version 3.33.4 released.
- 2026-04-03: disclosed: Public advisory published.

## References

- [https://github.com/Budibase/budibase/commit/5b0fe83d4ece52696b62589cba89ef50cc009732](https://github.com/Budibase/budibase/commit/5b0fe83d4ece52696b62589cba89ef50cc009732)
- [https://github.com/Budibase/budibase/pull/18236](https://github.com/Budibase/budibase/pull/18236)
- [https://github.com/Budibase/budibase/releases/tag/3.33.4](https://github.com/Budibase/budibase/releases/tag/3.33.4)
- [https://github.com/Budibase/budibase/security/advisories/GHSA-7r9j-r86q-7g45](https://github.com/Budibase/budibase/security/advisories/GHSA-7r9j-r86q-7g45)

## Related threats

- [Budibase SSRF via DNS rebinding in outbound fetch validation](https://junglewise.ai/threats/cve-2026-54353-budibase-ssrf-via-dns-rebinding-in-outbound-fetch-validation)
- [Budibase CSRF bypass via unanchored regex in Worker matchers](https://junglewise.ai/threats/cve-2026-48147-budibase-csrf-bypass-via-unanchored-regex-in-worker-matchers)
- [Budibase improper privilege management via missing cache invalidation](https://junglewise.ai/threats/cve-2026-46424-budibase-improper-privilege-management-via-missing-cache)
- [Budibase insecure session cookie configuration leads to account takeover](https://junglewise.ai/threats/cve-2026-42239-budibase-insecure-session-cookie-configuration-leads-to-account)
- [Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher , Unauthenticated Access to Protected Endpoints](https://junglewise.ai/threats/cve-2026-41428-budibase-authentication-bypass-via-unanchored-regex-in-public)