A flaw in Budibase's REST connector allows an attacker to direct the server to send requests to arbitrary URLs, bypassing the intended IP blacklist protection. The vulnerability results from an empty default blacklist environment variable, causing the SSRF guard to always return false and permitting unrestricted outbound traffic. The flaw is essentially a failure of a defensive filter that should reject or limit external requests.

All Budibase installations running versions earlier than 3.33.4 are affected, regardless of deployment mode or configuration. The issue affects every deployment setup that relies on Budibase's REST datasource connector, since the BLACKLIST_IPS variable is missing from the official deployment definitions.

The CVSS score of 9.6 denotes a severe vulnerability capable of remote code execution or data exfiltration. EPSS is below 1%, indicating a low likelihood of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred as interaction with the exposed REST API, which may be reachable by authenticated or unauthenticated users depending on the network configuration, and leveraging the bypassed SSRF checks.