CVE-2026-67311

mediumCVSS 6.8covered by 1 sourcefirst seen 2026-08-01

Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to internal IP addresses, bypassing blacklist protection to access cloud metadata endpoints and internal services.

⚡ Watch CVE-2026-67311

Get an email if CVE-2026-67311 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

mediumCVE-2026-67311: Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST dataso…nvd · 2026-08-01

External references

NVD record for CVE-2026-67311

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-67311 status](https://www.csirts.com/badge/CVE-2026-67311)](https://www.csirts.com/cve/CVE-2026-67311)