CVE-2026-67311 describes a server-side request forgery vulnerability in Budibase prior to version 3.38.1. The vulnerability arises from improper validation of HTTP redirects in the REST datasource integration component. Specifically, the system fails to enforce IP blacklist checks on redirected URLs, allowing an attacker with Builder privileges to craft a REST datasource that redirects to internal IP addresses. This bypasses blacklist protections and enables access to sensitive internal resources such as cloud metadata endpoints and internal services. The CVSS 3.1 base score is 6.8, indicating a high severity vulnerability with network attack vector, low attack complexity, and requiring high privileges but no user interaction. The impact is primarily confidentiality loss, with no integrity or availability impact reported.

An attacker with Builder role privileges can exploit this vulnerability to perform SSRF attacks that bypass IP blacklist protections. This can lead to unauthorized access to internal network resources and cloud metadata endpoints, potentially exposing sensitive information. The vulnerability does not affect integrity or availability but poses a significant confidentiality risk.

A fix is available in Budibase version 3.38.1. Users should upgrade to version 3.38.1 or later to remediate this vulnerability. Since no official patch links or vendor advisory content were provided, verify the patch status with the Budibase vendor advisory before applying. Until patched, restrict Builder role privileges to trusted users only to reduce risk.