Quick answers
- Is CVE-2026-73410 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-73410 being exploited in the wild.
- How severe is CVE-2026-73410?
- Low severity, with a CVSS score of 3.1, published 24 July 2026.
- Which products and versions are affected?
- @budibase/server (npm) SEMVER:introduced=0,last_affected=3.38.1.
- Is there a fix for CVE-2026-73410?
- A patch was published on 2026-07-24: Version 3.40.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-73410 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-73410?
- Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a TOCTOU (time-of-check-time-of-use) / DNS rebinding bypass in the REST datasource integration. Budibase's core fetchWithBlacklist function validates hostnames by resolving them and pinning the connection to a validated IP using a Node.js agent. However, the REST datasource component uses the undici HTTP client, which ignores the Node agent option and performs its own DNS resolution at connection time. An authenticated user (builder or tenant with REST datasource configuration rights) can craft a malicious hostname that resolves to a safe public IP during validation but to an internal IP (e.g., 127.0.0.1, 169.254.169.254, or internal service IPs) at actual connection time. This allows arbitrary HTTP requests to internal-only services with full response exfiltration, including read/write/delete operations. The fix is available in version 3.40.0.
Affected products
- Budibase Budibase <3.40.0
Identifiers
- CVE-2026-73410
- GHSA-v42f-v8xc-j435
Timeline
- 2026-07-22: disclosed
- 2026-07-24: patched: Version 3.40.0