EUVD-2026-60380
GHSA-v42f-v8xc-j435
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
DNS rebinding requires attacker-controlled infrastructure and precise timing (AC:H); builder-level authentication is mandatory (PR:L); internal service access constitutes a scope change (S:C) with full C/I/A impact on cloud credentials and datastores.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resolve the hostname again. A builder could use DNS rebinding to make packages/server/src/integrations/rest.ts connect to an internal address after a public address passed validation, with full response access and arbitrary REST methods. The fix adds createPinnedLookup support to the undici dispatcher and passes the validated address to custom fetch implementations. This issue is fixed in version 3.40.0.
AnalysisAI
SSRF via DNS rebinding in Budibase's REST datasource integration (versions prior to 3.40.0) lets an authenticated builder or tenant bypass the outbound-fetch IP blacklist by exploiting a TOCTOU gap between hostname validation and undici's independent DNS re-resolution at connection time. Because the REST integration overrides the transport with undici's fetch, the validated Node.js agent pin established by the prior CVE-2026-54353 fix is silently ignored, leaving the single most-used outbound path in Budibase unprotected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) an authenticated Budibase account assigned the builder role or equivalent tenant-level permission to configure and execute REST datasources - unauthenticated access is not sufficient; (2) control over an external domain and its authoritative DNS server, with the ability to serve different A/AAAA records before and after validation (DNS rebinding infrastructure with configurable TTL); and (3) a Budibase server running a version prior to 3.40.0 where the REST integration's undici dispatcher does not receive the pinned lookup function. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) accurately reflects the attack profile: network-accessible, but requiring high complexity due to the DNS rebinding timing window and a builder-level account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a Budibase builder account registers a domain they control, configures its authoritative DNS to return a routable public IP with a one-second TTL, and creates a REST datasource pointing to that domain. During Budibase's validation phase, the hostname resolves to the public IP, which passes the blacklist check. … |
| Remediation | Upgrade Budibase to version 3.40.0 or later, which exports `createPinnedLookup` from `outboundFetch.ts` and passes the validated IP into undici's custom dispatcher so both transport paths use the same pinned address, closing the TOCTOU window. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all REST datasource configurations, document their targets, and review recent activity logs for suspicious external connections to unfamiliar hosts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an
Authentication bypass in Budibase low-code platform (versions prior to 3.35.4) allows remote unauthenticated attackers t
Share
External POC / Exploit Code
Leaving vuln.today