External risk intelligence

Budibase SSRF Vulnerability Allows Unrestricted Requests

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-31818

Budibase is a low-code platform designed to build and host web applications and internal tools. These platforms are commonly deployed as internet-facing web services or portals to provide accessibility for users and connected data sources, making the underlying server-side infrastructure and its REST datasource connectors frequently reachable via the internet.

Server-Side Request Forgery

Budibase

before 3.33.4

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in the open-source Budibase low-code platform. A flaw in how the platform handles requests to external data sources could allow unauthorized access to internal systems and data if not properly configured. The primary concern is to confirm if your organization uses Budibase and, if so, whether it is affected by this issue.

Flaw in low-code platform's data access controls.
Confirms relevance and exposure of Budibase usage.
Understand scope; address if Budibase is in use.

Attack Path

How an attacker could exploit the issue

An attacker can leverage this vulnerability by interacting with the Budibase platform's REST datasource connector, which is accessible over the network. Because the server-side request forgery protection is ineffective by default, an attacker can trick the server into making requests to arbitrary internal or external resources. This can lead to sensitive data disclosure, unauthorized modifications, or denial of service.

Accessible over the network.
Triggers SSRF in the REST connector.
Sensitive data exposure and unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

A server-side request forgery vulnerability in Budibase's REST datasource connector could allow an unauthenticated attacker to make arbitrary requests to internal or external resources, potentially leading to unauthorized access to sensitive information or services. This occurs when the platform's SSRF protection is bypassed due to a default misconfiguration.

Internal network resources.
Requests made through the platform.
Unauthorized access to services.

Operational Fix

Recommended remediation, mitigation, and detection steps

System owners and platform teams are likely responsible for addressing this Server-Side Request Forgery (SSRF) vulnerability in Budibase, particularly if it's deployed as an internet-facing service. The first practical step is to inventory Budibase instances, determine their accessibility and criticality, identify the accountable owner, and then prioritize remediation based on risk.

Platform and application owners.
Verify Budibase instance exposure and criticality.
Plan and schedule updates for affected instances.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Budibase?

Budibase is an open-source, low-code development platform. Organizations use it to rapidly build, automate, and host internal business tools, web applications, and data dashboards. Because it connects to various data sources, it acts as a central hub for managing and visualizing enterprise information.

What does CWE-918 mean for CVE-2026-31818?

This CVE involves a Server-Side Request Forgery (SSRF) vulnerability. In simple terms, the software can be tricked into making network requests on behalf of an attacker. Because the platform's built-in security check for unauthorized IP addresses fails to activate by default, it inadvertently trusts and processes requests that it should have blocked.

How can this vulnerability be triggered?

An attacker triggers this by interacting with the Budibase REST datasource connector. The vulnerability exists because the protective IP blacklist is effectively disabled. It is important to note that simply having the software installed does not trigger the flaw; an attacker must specifically use the REST connector to send requests to unauthorized internal or external network locations.

Do I need to worry if my Budibase instance is internal?

According to Halo Surface Signal, Budibase is often deployed as an internet-facing portal to maintain accessibility for users and data sources. If your instance is exposed to the internet, it is at higher risk because the REST connector is reachable by external actors. If the instance is strictly internal, the risk is lower, though the vulnerability remains present if the software is outdated.

What is the first step to fix this?

The most effective way to secure your environment is to update your Budibase installation to version 3.33.4 or later. This update addresses the misconfiguration where the IP blacklist was not being enforced. Before updating, you should inventory your active instances to ensure all environments are accounted for and scheduled for the necessary maintenance.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.