Budibase: SSRF via DNS rebinding in the REST datasource integration
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resolve the hostname again. A builder could use DNS rebinding to make packages/server/src/integrations/rest.ts connect to an internal address after a public address passed validation, with full response access and arbitrary REST methods. The fix adds createPinnedLookup support to the undici dispatcher and passes the validated address to custom fetch implementations. This issue is fixed in version 3.40.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Budibase | budibase | before 3.40.0 | 3.40.0 | Patch available | CNA |
| — | @budibase/server (npm) | up to 3.38.1 | — | No fix listed | GHSA-v42f-v8xc-j435 |
- budibase VendorBudibase Affected before 3.40.0 Fixed in 3.40.0 Patch available CNA
- @budibase/server (npm) Vendor— Affected up to 3.38.1 Fixed in — No fix listed GHSA-v42f-v8xc-j435
Remediation
- Fix · CNA budibase (Budibase) Fixed in 3.40.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-73410
- 2026-10-03 Alias added: GHSA-v42f-v8xc-j435
References
Other 7
- https://github.com/Budibase/budibase/security/advisories/GHSA-v42f-v8xc-j435
- https://github.com/Budibase/budibase/commit/5758bdb242802ca20c4ed0dc579e4330ee898ef3
- https://github.com/Budibase/budibase/pull/19178
- https://github.com/Budibase/budibase/commit/1fecb3fc3497e8db7b60b42cc514ce304ffe3a41
- https://github.com/Budibase/budibase/commit/586802b5706367520d14245e18a7d0cabab0be11
- https://github.com/Budibase/budibase
- https://github.com/Budibase/budibase/releases/tag/3.39.30
More Budibase vulnerabilities
- TI-2026-39242 Budibase: Anonymous NoSQL operator injection via published-app query templates CVSS 3.1CRITICAL 10.0
- TI-2026-51076 Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook CVSS 4.0CRITICAL 9.0
- TI-2026-24369 Budibase Universal Auth Bypass via Webhook Query Param Injection CVSS 3.1CRITICAL 9.1
- TI-2026-56709 Budibase before 3.41.3 Remote Code Execution via Plugin eval() CVSS 4.0CRITICAL 9.4
- TI-2026-51425 Budibase: SQL Injection via `multipleStatements: true` CVSS 3.1CRITICAL 9.6
- TI-2026-51075 Budibase before 3.40.0 Arbitrary File Write via Path Traversal CVSS 4.0CRITICAL 9.4
Sources
- CVE-2026-73410 · CVE Program
- CVE-2026-73410 · NVD
- FIRST EPSS
- GHSA-v42f-v8xc-j435 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences