Budibase, an open‑source low‑code platform, allows authenticated users with automation permissions to trigger an outbound fetch operation. During input validation, the hostname is checked against a blacklist, but the actual socket connection performs a separate DNS lookup via node-fetch. An attacker can use DNS rebinding to make the validated hostname resolve to a public IP during validation and to a private or internal IP during the real connection. This bypass turns the validation into a non‑blind SSRF primitive, enabling a malicious user to reach internal services such as loopback interfaces, RFC1918 ranges, or cloud metadata endpoints, potentially exposing sensitive data or allowing further internal attacks.

Budibase Budibase platform versions earlier than 3.39.9 are vulnerable. No other vendors or products are listed.

The CVSS score of 8.5 indicates a high‑severity vulnerability. Because the exploit requires an authenticated user with automation permissions and operates through DNS rebinding, the attack vector is relatively narrow but still feasible. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog, although its severity warrants immediate attention. Exploitation would allow a determined attacker to access internal resources reachable from the Budibase host.