Home / Vulnerability Intelligence / CVE-2026-31818

CVE-2026-31818 - Vulnerability Analysis

CriticalCVSS: 9.6

Last Updated: April 3, 2026

Budibase - Server-Side Request Forgery

Published: April 3, 2026Updated: April 3, 2026Remote Exploitable

Overview

Budibase < 3.33.4 contains a server-side request forgery caused by an ineffective IP blacklist in the REST datasource connector, letting attackers make unrestricted requests, exploit requires network access.

Severity & Score

Severity: Critical

CVSS Score: 9.6

Impact

Attackers can make arbitrary server-side requests, potentially accessing internal resources or services.

Mitigation

Update to version 3.33.4 or later.

References

https://github.com/Budibase/budibase/commit/5b0fe83d4ece52696b62589cba89ef50cc009732
https://github.com/Budibase/budibase/pull/18236
https://github.com/Budibase/budibase/releases/tag/3.33.4
https://github.com/Budibase/budibase/security/advisories/GHSA-7r9j-r86q-7g45

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-31818
Severity: Critical
CVSS Score: 9.6
Type: server_side_request_forgery
Status: new

CWE

CWE-918

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N