Budibase, prior to version 3.38.1, contained an SSRF bypass in the REST datasource integration that ignored the IP blacklist after following HTTP redirects. An authenticated Builder can supply a REST datasource URL pointing to an attacker‑controlled server that redirects to an internal service, allowing that user to reach cloud metadata, databases, or other internal endpoints that should have been inaccessible. This flaw permits confidentiality exposure and the potential for further internal network compromise.

Budibase, all releases before 3.38.1, including the server package that performs REST integration without re‑checking the blacklist after a redirect.

The CVSS score of 7.7 indicates high severity. EPSS data is not available, but the exploit requires only an authenticated Builder account and an attacker‑controlled redirect server, making it a realistic threat for organizations with such users. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the SSRF by creating a malicious REST datasource, resulting in internal resource exposure and potential lateral movement.