CVE-2026-54353: Budibase SSRF via DNS rebinding in outbound fetch validation

CVE-2026-54353 · Severity: high · CVSS 8.5 · Published 2026-06-26

Budibase is an open-source low-code platform used to build internal business applications. A security flaw allows users with automation permissions to bypass internal security filters and access sensitive internal services, such as private databases, cloud metadata, or local server resources. This could lead to the exposure of internal data or temporary cloud credentials, potentially compromising the underlying infrastructure.

Technologies: Budibase Backend-Core, @budibase/backend-core (npm). Vendors: Budibase, npm.

Quick answers

Is CVE-2026-54353 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54353 being exploited in the wild.
How severe is CVE-2026-54353?
High severity, with a CVSS score of 8.5, published 26 June 2026.
Which products and versions are affected?
Budibase Backend-Core < 3.39.9; @budibase/backend-core (npm) < 3.39.9, SEMVER:introduced=0,fixed=3.39.9.
Is there a fix for CVE-2026-54353?
Yes. @budibase/backend-core (npm): upgrade to 3.39.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54353 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54353?
Check whether you run Budibase Backend-Core or @budibase/backend-core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @budibase/backend-core (npm): upgrade to 3.39.9 or later
    npm install @budibase/backend-core@3.39.9

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Budibase due to a Time-of-Check Time-of-Use (TOCTOU) flaw in the outbound fetch validation flow. The application performs a DNS lookup to validate a hostname against a blacklist but does not pin the resulting IP address. Consequently, the subsequent socket connection initiated by 'node-fetch' performs a second DNS lookup, which an attacker can manipulate via DNS rebinding to resolve to a private or loopback IP (e.g., 127.0.0.1, RFC1918, or 169.254.169.254). This allows authenticated users with automation permissions to perform non-blind SSRF, reading responses from internal services. The issue is fixed in version 3.39.9.

Affected products

  • Budibase budibase < 3.39.9

Identifiers

  • CVE-2026-54353
  • GHSA-gfq7-5x4g-3xhf

Timeline

  • 2026-06-04: advisory: GitHub Security Advisory published by Budibase
  • 2026-06-26: disclosed: CVE published to NVD
  • 2026-06-26: patched: Fix released in version 3.39.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.