CVE-2026-67311

EUVD-2026-51822
Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to internal IP addresses, bypassing blacklist protection to access cloud metadata endpoints and internal services.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.8 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
budibasebudibase
𝑥
< 3.38.1
CNA
Common Weakness Enumeration
References
https://github.com/Budibase/budibase/security/advisories/GHSA-86f3-cqpq-wp9m
https://www.vulncheck.com/advisories/budibase-before-ssrf-blacklist-bypass-via-http-redirect