THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-67311 (MEDIUM 6.8) — Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a

[NVD] CVE-2026-67311 (MEDIUM 6.8) — Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a

mednvdPublished 2026-08-01

CVE-2026-67311 CVSS: 6.8 MEDIUM Published: 2026-08-01T13:17:01.000

Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to internal IP addresses, bypassing blackl

MITRE ATT&CK techniques

IP AddressesT1590.005

Indicators of compromise

CVE-2026-67311cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-67311