CVE-2026-31818: SSRF in Budibase REST Connector

The SSRF vulnerability arises from a weakness in Budibase's REST Datasource integration and its backend blacklist module. An attacker can craft malicious REST queries that bypass the intended blacklist, enabling them to make requests to internal services and resources that should be inaccessible from the outside. This can lead to the exposure of sensitive data, including configuration files, database credentials, and other internal assets. The lack of user interaction required for exploitation significantly increases the risk, as an attacker can trigger the vulnerability remotely without any user action. The potential for data exfiltration is substantial, particularly in environments where internal services are not adequately secured.

1. Reserved2026-03-09
2. Published2026-04-03
3. EPSS updated2026-04-11

The primary mitigation for CVE-2026-31818 is to immediately upgrade Budibase to version 3.33.4 or later. This version includes a corrected blacklist implementation that effectively prevents the SSRF vulnerability. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) or proxy to filter outbound requests and block connections to internal resources. Additionally, review and restrict the permissions granted to Builder roles and QUERY WRITE access to minimize the potential attack surface. Monitor Budibase logs for suspicious outbound requests to internal services.