Executive brief
Budibase, a platform for building internal business applications, contains a vulnerability that allows authorized users to bypass security restrictions and access internal network services. By using a technique called DNS rebinding, an attacker can trick the server into connecting to private internal resources or the server itself, which are normally blocked. This could lead to the exposure of sensitive internal data or unauthorized access to other services running within the organization's private network.
Technical details
Budibase suffers from two SSRF bypasses due to insufficient DNS pinning during outbound fetch operations. The first bypass exists in the OpenAPI query import, where a 'time-of-check to time-of-use' (TOCTOU) gap allows a hostname to resolve to a public IP during validation but a private IP (e.g., 127.0.0.1) during the actual fetch. The second bypass occurs in REST datasource execution because the 'undici' fetch implementation ignores the pinned Node.js agent and performs its own DNS resolution at connection time. An authenticated user with builder-level privileges can exploit these by configuring a malicious DNS server to rebind a hostname to internal IP addresses, bypassing outbound fetch protections. The issue is addressed in version 3.39.30.
Affected products
- Budibase Budibase <= 3.38.1
Timeline
- 2026-07-22: disclosed: Advisory published by Budibase team
- 2026-07-24: advisory: GitHub Advisory Database entry reviewed and updated