Executive brief
Budibase is an open-source low-code platform used to build internal business applications. A security flaw allows users with automation permissions to bypass internal security filters and access sensitive internal services, such as private databases, cloud metadata, or local server resources. This could lead to the exposure of internal data or temporary cloud credentials, potentially compromising the underlying infrastructure.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Budibase due to a Time-of-Check Time-of-Use (TOCTOU) flaw in the outbound fetch validation flow. The application performs a DNS lookup to validate a hostname against a blacklist but does not pin the resulting IP address. Consequently, the subsequent socket connection initiated by 'node-fetch' performs a second DNS lookup, which an attacker can manipulate via DNS rebinding to resolve to a private or loopback IP (e.g., 127.0.0.1, RFC1918, or 169.254.169.254). This allows authenticated users with automation permissions to perform non-blind SSRF, reading responses from internal services. The issue is fixed in version 3.39.9.
Affected products
- Budibase budibase < 3.39.9
Timeline
- 2026-06-04: advisory: GitHub Security Advisory published by Budibase
- 2026-06-26: disclosed: CVE published to NVD
- 2026-06-26: patched: Fix released in version 3.39.9