CVE-2026-67311 Overview
CVE-2026-67311 is a Server-Side Request Forgery (SSRF) vulnerability in Budibase versions before 3.38.1. The flaw resides in the REST datasource integration, which fails to validate HTTP redirects against the configured IP blacklist. An authenticated user with the Builder role can create a REST datasource pointing to an attacker-controlled external server. That server returns an HTTP redirect to an internal address, and Budibase follows the redirect without re-checking the destination. The bypass grants access to cloud metadata endpoints and internal services normally protected by the blacklist. This weakness is tracked under [CWE-918].
Critical Impact
Authenticated Builder-role users can pivot from Budibase to internal networks and cloud instance metadata services, exposing credentials and sensitive infrastructure data.
Affected Products
- Budibase versions prior to 3.38.1
- Self-hosted Budibase deployments exposing REST datasource configuration
- Cloud-hosted Budibase instances where Builder role is delegated to untrusted users
Discovery Timeline
- 2026-08-01 - CVE-2026-67311 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-67311
Vulnerability Analysis
Budibase implements an IP blacklist in the REST datasource integration to prevent requests targeting private and link-local address ranges. The blacklist check runs against the initial request URL supplied by the user. When the remote server responds with an HTTP 3xx redirect, the HTTP client follows the Location header without applying the same validation. An attacker hosts a server that returns 302 Found with Location: http://169.254.169.254/latest/meta-data/ or another internal target. Budibase issues the follow-up request from the server backend, returning the response body to the Builder user. The primary consequence is confidentiality loss, including exfiltration of cloud instance metadata, IAM credentials, and internal API responses.
Root Cause
The root cause is missing redirect validation in the REST integration's HTTP client. The blacklist enforcement executes once, at request initiation, rather than on every hop of the request chain. This design assumption breaks when the outbound HTTP library transparently follows redirects.
Attack Vector
Exploitation requires Builder-role privileges within a Budibase workspace. The attacker configures a REST datasource with a URL pointing to an external host they control. That host answers with a redirect to any internal or metadata IP. Budibase resolves the redirect server-side and returns the fetched content to the caller. No user interaction beyond the Builder session is required. Refer to the GitHub Security Advisory and the VulnCheck SSRF Advisory for technical details.
Detection Methods for CVE-2026-67311
Indicators of Compromise
- Outbound HTTP requests from Budibase backend servers to external hosts followed immediately by requests to RFC 1918 or link-local ranges such as 169.254.169.254.
- Newly created REST datasources referencing unfamiliar external domains, particularly short-lived or dynamic DNS hostnames.
- Access to cloud metadata endpoints (AWS IMDS, GCP metadata, Azure IMDS) originating from the Budibase service account.
Detection Strategies
- Inspect application logs for REST datasource requests that traversed a 3xx redirect chain terminating at internal addresses.
- Correlate Builder-role activity in Budibase audit logs with egress network flows to unusual destinations.
- Deploy egress filtering rules that log or block Budibase host connections to internal RFC 1918 ranges and cloud metadata IPs.
Monitoring Recommendations
- Alert on any HTTP response with status codes 301, 302, 303, 307, or 308 whose Location header resolves to a private, loopback, or metadata IP.
- Monitor cloud instance metadata service (IMDS) request patterns for calls originating from application workloads that historically did not require them.
- Track creation and modification of REST datasources through Budibase audit events and route them into centralized logging.
How to Mitigate CVE-2026-67311
Immediate Actions Required
- Upgrade Budibase to version 3.38.1 or later on all self-hosted deployments.
- Restrict Builder role assignment to a minimum set of trusted administrators until patching is complete.
- Enforce IMDSv2 with session tokens on AWS workloads hosting Budibase to prevent unauthenticated metadata retrieval.
Patch Information
Budibase addressed the redirect handling defect in version 3.38.1. The fix applies IP blacklist validation to each hop in the redirect chain rather than only the initial request URL. Review the GitHub Security Advisory GHSA-86f3-cqpq-wp9m for release notes and upgrade guidance.
Workarounds
- Place Budibase behind an egress proxy that rejects connections to RFC 1918, loopback, and cloud metadata address ranges.
- Disable the REST datasource integration if it is not required by workspace applications.
- Apply network segmentation that isolates the Budibase backend from cloud metadata endpoints and sensitive internal services.
# Example iptables egress restriction for the Budibase host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 443 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp --dport 80 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 80 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
