Is CVE-2026-72855 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-72855 being exploited in the wild.

How severe is CVE-2026-72855?

High severity, with a CVSS score of 8.5, published 13 August 2026.

Which products and versions are affected?

@budibase/server (npm) SEMVER:introduced=0,last_affected=3.38.1.

Is there a fix for CVE-2026-72855?

A patch was published on 2026-07-24: version 3.40.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-72855 attacked?

It is attacked over the network.

Am I affected by CVE-2026-72855?

Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-72855: Budibase DNS rebinding SSRF in OpenAPI import and REST execution

CVE-2026-72855 · Severity: high · CVSS 8.5 · Published 2026-08-13

Budibase is a low-code application platform that allows builders to configure data sources and import external APIs. A builder-level user can exploit DNS rebinding to bypass network security controls and make the Budibase server perform HTTP requests to internal services (like loopback addresses) that should be blocked. This allows attackers with builder privileges to access private systems, potentially extracting sensitive data or compromising internal infrastructure.

Technologies: @budibase/server (npm). Vendors: npm.

Quick answers

Is CVE-2026-72855 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-72855 being exploited in the wild.
How severe is CVE-2026-72855?: High severity, with a CVSS score of 8.5, published 13 August 2026.
Which products and versions are affected?: @budibase/server (npm) SEMVER:introduced=0,last_affected=3.38.1.
Is there a fix for CVE-2026-72855?: A patch was published on 2026-07-24: version 3.40.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-72855 attacked?: It is attacked over the network.
Am I affected by CVE-2026-72855?: Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a DNS rebinding SSRF (CWE-918) affecting two code paths: OpenAPI query import and REST datasource/query execution. In OpenAPI import (packages/server/src/api/controllers/query/import/index.ts), the code validates a hostname against a blacklist but then performs a separate raw fetch, creating a TOCTOU gap where DNS can resolve to a different address between validation and connection. In REST execution (packages/server/src/integrations/rest.ts), the helper passes a pinned Node agent but the custom undici dispatcher re-resolves the hostname at connection time, defeating DNS pinning protections. An authenticated builder can craft a rebinding hostname that resolves to a public address during validation and to 127.0.0.1 during the actual request. The attack requires builder-level authentication and network reachability to a controlled DNS server but no user interaction. Affected versions prior to 3.40.0 allow reaching loopback and private HTTP services.

Affected products

Budibase Budibase <3.40.0

Identifiers

CVE-2026-72855
GHSA-xg5g-26x8-cvf4

Timeline

2026-07-24: disclosed
2026-07-24: patched: version 3.40.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.