CVE-2026-67311 in Budibase
Summary
by MITRE • 08/01/2026
Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to internal IP addresses, bypassing blacklist protection to access cloud metadata endpoints and internal services.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability under analysis represents a critical server-side request forgery flaw in Budibase versions prior to 3.38.1, specifically affecting the REST datasource integration component. This issue stems from insufficient validation of HTTP redirects within the data source configuration process, creating a pathway for malicious actors to bypass established security controls. The flaw exists in the handling of network requests where the application fails to properly enforce IP address restrictions during redirect processing, allowing attackers to manipulate the request flow through external servers that return controlled redirects.
The technical implementation of this vulnerability occurs within the REST datasource integration module where HTTP client libraries are invoked without adequate sanitization of redirect responses. When a user configures a REST datasource, the system performs an initial request to the specified endpoint and subsequently follows any redirects returned by the server. The security mechanism intended to block access to internal IP ranges through IP blacklists becomes ineffective because the validation logic only examines the original request destination rather than the final resolved address after following redirects. This creates a scenario where attackers can craft malicious external endpoints that return HTTP 301 or 302 redirects pointing to internal cloud metadata services or private network addresses.
The operational impact of this vulnerability is significant for organizations using Budibase, particularly those with Builder user roles who possess the ability to configure data sources. Attackers with minimal privileges can leverage this flaw to access sensitive internal infrastructure including AWS metadata endpoints, Azure instance metadata services, and other cloud provider internal APIs that typically should remain isolated from external access. The potential attack surface extends beyond simple information disclosure to include possible privilege escalation opportunities if the metadata endpoints contain authentication tokens or other sensitive credentials that could be harvested through this redirect bypass mechanism.
This vulnerability aligns with CWE-918, which specifically addresses server-side request forgery conditions where applications fail to validate redirect targets against known safe destinations. The flaw also maps to ATT&CK technique T1071.004, covering application layer protocol: DNS, as attackers may use DNS redirection techniques to bypass IP-based restrictions. Additionally, the vulnerability demonstrates characteristics of T1566.002, representing phishing with social engineering, since attackers often need to create convincing external endpoints to fool the system's redirect validation process.
Organizations should implement immediate mitigations including upgrading to Budibase version 3.38.1 or later where proper redirect validation has been implemented. The fix requires strengthening the HTTP client configuration to validate all redirect targets against the existing IP blacklist, ensuring that any subsequent addresses encountered during redirect chains are checked against internal address ranges before allowing network access. Network-level protections such as outbound firewall rules and proxy configurations can serve as additional defensive measures to prevent access to known internal services even if the application-level fix is not immediately available. Regular security assessments of data source configurations should be conducted to identify and remediate any potentially malicious or misconfigured REST endpoints that could be exploited through similar redirect mechanisms.