Budibase SSRF Flaw: Default Config Leaves Open-Source Low-Code Exposed

CVE Notify is flagging a critical Server-Side Request Forgery (SSRF) vulnerability impacting the open-source low-code platform, Budibase. The flaw, identified as CVE-2026-31818, affects versions prior to 3.33.4. According to CVE Notify, the issue stems from Budibase’s REST datasource connector where the built-in SSRF protection mechanism is rendered useless. The problem? The crucial BLACKLIST_IPS environment variable isn’t set by default in official deployment configurations. This oversight means the blacklist function always returns false, allowing unrestricted requests to bypass security checks.

This is a classic case of a security feature being present but not properly enabled out-of-the-box. CVE Notify highlights that when BLACKLIST_IPS is empty, the SSRF protection is effectively nullified. Attackers could potentially leverage this to target internal network resources or external services that the Budibase server has access to, leading to data exfiltration or further network compromise. The good news is that this has been patched in Budibase version 3.33.4.