# CVE-2026-73410: Budibase SSRF via DNS rebinding in REST datasource

Source: https://junglewise.ai/threats/cve-2026-73410-budibase-ssrf-via-dns-rebinding-in-rest-datasource  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73410 · Severity: low · CVSS 3.1 · Published 2026-07-24

Budibase's REST datasource integration allows authenticated users to query external APIs and databases. A critical flaw in the DNS rebinding protection means an attacker can bypass IP address validation and redirect requests to internal services (cloud metadata endpoints, databases, internal APIs), potentially stealing cloud credentials or accessing sensitive internal data.

Technologies: [@budibase/server (npm)](https://junglewise.ai/threats/technologies/budibase-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-73410 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73410 being exploited in the wild.

**How severe is CVE-2026-73410?** Low severity, with a CVSS score of 3.1, published 24 July 2026.

**Which products and versions are affected?** @budibase/server (npm) SEMVER:introduced=0,last_affected=3.38.1.

**Is there a fix for CVE-2026-73410?** A patch was published on 2026-07-24: Version 3.40.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73410 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73410?** Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a TOCTOU (time-of-check-time-of-use) / DNS rebinding bypass in the REST datasource integration. Budibase's core fetchWithBlacklist function validates hostnames by resolving them and pinning the connection to a validated IP using a Node.js agent. However, the REST datasource component uses the undici HTTP client, which ignores the Node agent option and performs its own DNS resolution at connection time. An authenticated user (builder or tenant with REST datasource configuration rights) can craft a malicious hostname that resolves to a safe public IP during validation but to an internal IP (e.g., 127.0.0.1, 169.254.169.254, or internal service IPs) at actual connection time. This allows arbitrary HTTP requests to internal-only services with full response exfiltration, including read/write/delete operations. The fix is available in version 3.40.0.

## Affected products

- Budibase Budibase <3.40.0

## Identifiers

- CVE-2026-73410
- GHSA-v42f-v8xc-j435

## Timeline

- 2026-07-22: disclosed
- 2026-07-24: patched: Version 3.40.0

## References

- [https://github.com/Budibase/budibase/security/advisories/GHSA-v42f-v8xc-j435](https://github.com/Budibase/budibase/security/advisories/GHSA-v42f-v8xc-j435)
- [https://github.com/Budibase/budibase/pull/19178](https://github.com/Budibase/budibase/pull/19178)

## Related threats

- [Budibase S3 signed upload URL issuance via attachments endpoint](https://junglewise.ai/threats/cve-2026-54356-budibase-s3-signed-upload-url-issuance-via-attachments-endpoint)
- [Budibase automation SSRF in webhook and integration steps](https://junglewise.ai/threats/cve-2026-35219-budibase-automation-ssrf-in-webhook-and-integration-steps)
- [Budibase S3 presigned URL authorization regression](https://junglewise.ai/threats/cve-2026-72859-budibase-s3-presigned-url-authorization-regression)
- [Budibase MySQL DESCRIBE backtick injection via multipleStatements](https://junglewise.ai/threats/cve-2026-73408-budibase-mysql-describe-backtick-injection-via-multiplestatements)
- [Budibase privilege escalation in public role assignment API](https://junglewise.ai/threats/cve-2026-73305-budibase-privilege-escalation-in-public-role-assignment-api)