Description
Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resolve the hostname again. A builder could use DNS rebinding to make packages/server/src/integrations/rest.ts connect to an internal address after a public address passed validation, with full response access and arbitrary REST methods. The fix adds createPinnedLookup support to the undici dispatcher and passes the validated address to custom fetch implementations. This issue is fixed in version 3.40.0.
Published: 2026-08-17
Score: 8.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a Server‑Side Request Forgery that allows a builder to circumvent DNS host‑name verification by exploiting DNS rebinding. A validated public address is resolved again by the underlying HTTP client, permitting the integration to establish a connection to a local internal address and issue arbitrary REST methods with full response visibility. This can lead to disclosure of internal network information, manipulation of internal services, or potential lateral movement within the network.

Affected Systems

Budibase users running any version prior to 3.40.0 are impacted. The fix is bundled in the 3.40.0 release. All builds of the Budibase platform before that version that expose the REST datasource integration are susceptible.

Risk and Exploitability

The CVSS score of 8.5 indicates a high severity, but the EPSS score is not available, making it unclear how often it is actively exploited. It is not listed in CISA KEV, suggesting no widespread known exploitation. The most likely attack vector involves a malicious DNS responder or a compromised DNS server that can redirect a public hostname to an internal target. An attacker would need to control the DNS infrastructure or influence the DNS query path for the affected instance.

Generated by OpenCVE AI on August 17, 2026 at 21:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Budibase to version 3.40.0 or newer, which adds proper DNS pinning to the fetch dispatcher.
  • Restrict outbound REST connections by configuring network firewalls or using proxy settings so that only allowed internal or external endpoints are reachable.
  • Validate DNS responses by enabling DNS filtering or explicit hostname checks to prevent rebinding attacks.

Generated by OpenCVE AI on August 17, 2026 at 21:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-v42f-v8xc-j435 Budibase: SSRF via DNS rebinding in the REST datasource integration
History

Mon, 17 Aug 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 17 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Budibase
Budibase budibase
Vendors & Products Budibase
Budibase budibase

Mon, 17 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Description Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resolve the hostname again. A builder could use DNS rebinding to make packages/server/src/integrations/rest.ts connect to an internal address after a public address passed validation, with full response access and arbitrary REST methods. The fix adds createPinnedLookup support to the undici dispatcher and passes the validated address to custom fetch implementations. This issue is fixed in version 3.40.0.
Title Budibase: SSRF via DNS rebinding in the REST datasource integration
Weaknesses CWE-367
CWE-918
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Budibase Budibase
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-17T22:01:01.232Z

Reserved: 2026-08-12T14:32:11.795Z

Link: CVE-2026-73410

cve-icon Vulnrichment

Updated: 2026-08-17T21:59:13.109Z

cve-icon NVD

Status : Received

Published: 2026-08-17T21:16:48.823

Modified: 2026-08-17T22:17:26.780

Link: CVE-2026-73410

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-17T21:45:03Z

Weaknesses
  • CWE-367

    Time-of-check Time-of-use (TOCTOU) Race Condition

  • CWE-918

    Server-Side Request Forgery (SSRF)