CVE-2026-31818

The BLACKLIST_IPS environment variable, responsible for defining a list of blocked IP addresses, is not set by default in any of Budibase's official deployment configurations. When this variable is empty, the blacklist checking function unconditionally returns false, allowing all requests through without any verification. An authenticated user can thus use the REST datasource connector to direct the server to execute HTTP requests to any internal or external network resources. The vulnerability encompasses CWE-918 (SSRF) and CWE-1188 (insecure default initialization).

An attacker with access to a user account can gain access to internal network infrastructure resources (e.g., cloud metadata services, internally-accessible systems not publicly available) and potentially exfiltrate sensitive data or compromise the integrity of internal systems.

Update Budibase to version 3.33.4 or later, in which the vulnerability has been patched. As a temporary workaround, you can manually set the BLACKLIST_IPS environment variable according to the vendor's recommendations described in the references.

Budibase in versions before 3.33.4 — affects all official deployment configurations in which the BLACKLIST_IPS variable is not manually set