# CVE-2026-72855: Budibase DNS rebinding SSRF in OpenAPI import and REST execution

Source: https://junglewise.ai/threats/cve-2026-72855-budibase-dns-rebinding-ssrf-in-openapi-import-and-rest-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-72855 · Severity: high · CVSS 8.5 · Published 2026-08-13

Budibase is a low-code application platform that allows builders to configure data sources and import external APIs. A builder-level user can exploit DNS rebinding to bypass network security controls and make the Budibase server perform HTTP requests to internal services (like loopback addresses) that should be blocked. This allows attackers with builder privileges to access private systems, potentially extracting sensitive data or compromising internal infrastructure.

Technologies: [@budibase/server (npm)](https://junglewise.ai/threats/technologies/budibase-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-72855 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-72855 being exploited in the wild.

**How severe is CVE-2026-72855?** High severity, with a CVSS score of 8.5, published 13 August 2026.

**Which products and versions are affected?** @budibase/server (npm) SEMVER:introduced=0,last_affected=3.38.1.

**Is there a fix for CVE-2026-72855?** A patch was published on 2026-07-24: version 3.40.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-72855 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-72855?** Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a DNS rebinding SSRF (CWE-918) affecting two code paths: OpenAPI query import and REST datasource/query execution. In OpenAPI import (packages/server/src/api/controllers/query/import/index.ts), the code validates a hostname against a blacklist but then performs a separate raw fetch, creating a TOCTOU gap where DNS can resolve to a different address between validation and connection. In REST execution (packages/server/src/integrations/rest.ts), the helper passes a pinned Node agent but the custom undici dispatcher re-resolves the hostname at connection time, defeating DNS pinning protections. An authenticated builder can craft a rebinding hostname that resolves to a public address during validation and to 127.0.0.1 during the actual request. The attack requires builder-level authentication and network reachability to a controlled DNS server but no user interaction. Affected versions prior to 3.40.0 allow reaching loopback and private HTTP services.

## Affected products

- Budibase Budibase <3.40.0

## Identifiers

- CVE-2026-72855
- GHSA-xg5g-26x8-cvf4

## Timeline

- 2026-07-24: disclosed
- 2026-07-24: patched: version 3.40.0 released

## References

- [https://github.com/Budibase/budibase/security/advisories/GHSA-xg5g-26x8-cvf4](https://github.com/Budibase/budibase/security/advisories/GHSA-xg5g-26x8-cvf4)
- [https://github.com/Budibase/budibase/pull/19178](https://github.com/Budibase/budibase/pull/19178)

## Related threats

- [Budibase S3 signed upload URL issuance via attachments endpoint](https://junglewise.ai/threats/cve-2026-54356-budibase-s3-signed-upload-url-issuance-via-attachments-endpoint)
- [Budibase automation SSRF in webhook and integration steps](https://junglewise.ai/threats/cve-2026-35219-budibase-automation-ssrf-in-webhook-and-integration-steps)
- [Budibase S3 presigned URL authorization regression](https://junglewise.ai/threats/cve-2026-72859-budibase-s3-presigned-url-authorization-regression)
- [Budibase MySQL DESCRIBE backtick injection via multipleStatements](https://junglewise.ai/threats/cve-2026-73408-budibase-mysql-describe-backtick-injection-via-multiplestatements)
- [Budibase privilege escalation in public role assignment API](https://junglewise.ai/threats/cve-2026-73305-budibase-privilege-escalation-in-public-role-assignment-api)