What is the CVSS score of EUVD-2026-60380?

EUVD-2026-60380 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Budibase are affected by EUVD-2026-60380?

Budibase REST datasource integration (versions prior to 3.40.0) contains a network bypass vulnerability that allows authenticated users to circumvent security controls and access cloud credential…. A patch is available.

How to fix or mitigate EUVD-2026-60380?

Within 24 hours, audit all REST datasource configurations, document their targets, and review recent activity logs for suspicious external connections to unfamiliar hosts. Within 7 days, implement network-level controls including egress rules to block access to cloud metadata services, restrict REST datasource configuration to authorized administrators, and establish detailed audit logging. Within 30 days, upgrade to Budibase 3.40.0 or later if available; if no patch is released, deploy permanent mitigations including DNS security controls at the gateway level, network segmentation isolating Budibase from internal services, and approval workflows for any datasource configuration changes.

Budibase EUVD-2026-60380

| CVE-2026-73410 HIGH

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-08-17 GitHub_M

GHSA-v42f-v8xc-j435

RCE Budibase

8.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.5 HIGH

DNS rebinding requires attacker-controlled infrastructure and precise timing (AC:H); builder-level authentication is mandatory (PR:L); internal service access constitutes a scope change (S:C) with full C/I/A impact on cloud credentials and datastores.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 17, 2026 - 22:03 EUVD

Source Code Evidence Fetched

Aug 17, 2026 - 20:49 vuln.today

Analysis Generated

Aug 17, 2026 - 20:49 vuln.today

CVE Published

Aug 17, 2026 - 20:27 cve.org

HIGH 8.5

DescriptionCVE.org

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resolve the hostname again. A builder could use DNS rebinding to make packages/server/src/integrations/rest.ts connect to an internal address after a public address passed validation, with full response access and arbitrary REST methods. The fix adds createPinnedLookup support to the undici dispatcher and passes the validated address to custom fetch implementations. This issue is fixed in version 3.40.0.

AnalysisAI

SSRF via DNS rebinding in Budibase's REST datasource integration (versions prior to 3.40.0) lets an authenticated builder or tenant bypass the outbound-fetch IP blacklist by exploiting a TOCTOU gap between hostname validation and undici's independent DNS re-resolution at connection time. Because the REST integration overrides the transport with undici's fetch, the validated Node.js agent pin established by the prior CVE-2026-54353 fix is silently ignored, leaving the single most-used outbound path in Budibase unprotected. An attacker who can configure a REST datasource can reach cloud instance-metadata endpoints to steal IAM credentials, or read from and write to internal services such as CouchDB, Redis, and MinIO with full HTTP method and response access. No public exploit has been identified at time of analysis.

Technical ContextAI

Budibase's central outbound-fetch guard (fetchWithBlacklist in packages/backend-core/src/utils/outboundFetch.ts) resolves a target hostname, validates every resolved IP against an SSRF blacklist, and pins the validated address into a custom Node.js http.Agent/https.Agent via makePinnedAgent, whose overridden lookup function always returns the vetted IP. This pin was the core of the CVE-2026-54353 fix. The REST datasource integration (packages/server/src/integrations/rest.ts) overrides the fetch transport with undici's fetch, which does not honour the Node agent option - it is silently dropped. Undici instead uses its own dispatcher (via getDispatcher), which performs a completely independent DNS resolution at connection time. This creates a textbook CWE-367 (Time-of-check Time-of-use) race: the check phase resolves the hostname and validates the IP, while the use phase re-resolves it through an entirely separate code path with no memory of the validated address. An attacker who controls their domain's DNS TTL can serve a public IP during the check phase and switch to an internal RFC-1918 or link-local address (e.g., 169.254.169.254) before the undici dispatcher connects. The fix introduces createPinnedLookup as an exported function and threads the validated IP into a custom undici dispatcher so both Node-fetch and undici paths receive a pinned lookup. The affected CPE is cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:* for all versions prior to 3.40.0.

RemediationAI

Upgrade Budibase to version 3.40.0 or later, which exports createPinnedLookup from outboundFetch.ts and passes the validated IP into undici's custom dispatcher so both transport paths use the same pinned address, closing the TOCTOU window. The fix commit is 5758bdb242802ca20c4ed0dc579e4330ee898ef3 and the vendor advisory is at https://github.com/Budibase/budibase/security/advisories/GHSA-v42f-v8xc-j435; note that the GHSA package record shows 'fixed in: None' for npm/@budibase/server <= 3.38.1, which conflicts with the CVE description citing 3.40.0 - verify the exact patched release against the official npm registry before deploying. If an immediate upgrade is not feasible, restrict the builder and tenant roles so that only fully trusted internal users can configure or execute REST datasources, as this removes the low-privilege account vector the attack depends on. As a network-layer compensating control, configure egress firewall rules or cloud security groups to block outbound HTTP/HTTPS from the Budibase server process to RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the link-local metadata address (169.254.169.254); be aware that this will also block any legitimate REST datasources that intentionally target internal endpoints. For cloud deployments specifically, blocking or null-routing 169.254.169.254 at the hypervisor or VPC level provides a high-value, low-disruption mitigation for the credential-theft vector.