The Budibase low‑code platform allows a server‑side request forgery through its REST datasource connector when the environment variable controlling IP blacklisting is unset. This removes the protection layer and permits an attacker to cause the server to make arbitrary outbound HTTP requests. The weakness is identified as CWE‑918 and CWE‑1188, meaning an attacker can force the application to reach internal or external resources that should be inaccessible, potentially exposing sensitive information or enabling lateral movement.

Any installation of Budibase older than version 3.33.4 is affected. The vulnerability resides in the REST connector component of the platform, regardless of deployment method, because the default configuration does not assign the BLACKLIST_IPS variable.

The CVSS score is 9.6, indicating critical severity. There is no EPSS value or KEV listing, but the lack of active protection makes exploitation straightforward once the attacker can invoke the REST connector, typically via authenticated or unauthenticated user access. The attack path relies on constructing a request to the connector with a target URL; with the blacklist check bypassed, the request proceeds unfiltered. The risk remains high until the patch or a workaround is applied.