CVE-2026-67311CWE-918ssrf

CVE-2026-67311

Medium · published August 1, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
34.8
In the wild
Unconfirmed
What it is

Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to internal IP addresses, bypassing blacklist protection to access cloud metadata endpoints and internal services.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00416 · 34.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-08-01T17:17Z
References (3)
https://github.com/Budibase/budibase/security/advisories/GHSA-86f3-cqpq-wp9m · [email protected]https://www.vulncheck.com/advisories/budibase-before-ssrf-blacklist-bypass-via-http-redirect · [email protected]https://github.com/Budibase/budibase/security/advisories/GHSA-86f3-cqpq-wp9m · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 01 AUG 12:22Z
    Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect
    cvelistv5