{"id":"EUVD-2026-58504","revision":null,"records":[{"revision":"0611d7ceb35149fb816194d7a541d451","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-72855","aliases":[],"title":"Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST","description":"Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public addresses during validation but resolve to loopback or private addresses during actual connection, allowing access to blocked internal HTTP services.","state":0,"publishedAt":"2026-08-13T21:54:44.625+00:00","modifiedAt":"2026-10-08T15:24:37.059+00:00","affected":[{"ecosystem":"Vendor product","name":"server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"budibase\",\n                    \"product\": \"server\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/%40budibase/server\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.40.0\"\n                        },\n                        {\n                            \"version\": \"3.40.0\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","score":8.4,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","score":8.5,"severity":"HIGH"}],"references":["https://github.com/Budibase/budibase/security/advisories/GHSA-xg5g-26x8-cvf4","https://www.vulncheck.com/advisories/budibase-before-dns-rebinding-ssrf-via-openapi-and-rest"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72855","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-72855","identifiers":["CVE-2026-72855"]},"retained":false,"historicalAffected":[]},{"revision":"ce2033fcf5d14e4fb75680930bf4a1cc","observedAt":"2026-11-09T15:08:47.608+00:00","statement":{"source":"euvd","id":"EUVD-2026-58504","aliases":["CVE-2026-72855","GHSA-9x7q-v2pf-x72v"],"title":"Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attac…","description":"Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public addresses during validation but resolve to loopback or private addresses during actual connection, allowing access to blocked internal HTTP services.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","score":8.4,"severity":null}],"references":["https://github.com/Budibase/budibase/security/advisories/GHSA-xg5g-26x8-cvf4","https://www.vulncheck.com/advisories/budibase-before-dns-rebinding-ssrf-via-openapi-and-rest"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-58504","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 13, 2026, 9:54:44 PM","dateUpdated":"Oct 8, 2026, 3:24:37 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-58504","identifiers":["EUVD-2026-58504","CVE-2026-72855","GHSA-9x7q-v2pf-x72v"]},"retained":false,"historicalAffected":[]},{"revision":"c6913915338b452c9b97b7b165bb4505","observedAt":"2026-10-25T15:19:03.401+00:00","statement":{"source":"nvd","id":"CVE-2026-72855","aliases":[],"title":"Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attac…","description":"Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public addresses during validation but resolve to loopback or private addresses during actual connection, allowing access to blocked internal HTTP services.","state":0,"publishedAt":"2026-08-13T22:17:24.753+00:00","modifiedAt":"2026-10-08T16:17:37.09+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.4,"severity":"HIGH"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","score":8.5,"severity":"HIGH"}],"references":["https://github.com/Budibase/budibase/security/advisories/GHSA-xg5g-26x8-cvf4","https://www.vulncheck.com/advisories/budibase-before-dns-rebinding-ssrf-via-openapi-and-rest"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72855","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-918"],"productCriteria":[],"sourceDates":{"published":"2026-08-13T22:17:24.753","lastModified":"2026-10-08T16:17:37.090"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-72855","identifiers":["CVE-2026-72855"]},"retained":false,"historicalAffected":[]},{"revision":"ada96518d6b440f0acfc0a228fee3288","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-xg5g-26x8-cvf4","aliases":["CVE-2026-72855"],"title":" Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution","description":"## Impact\n\nA builder-level user can make Budibase issue server-side HTTP requests to loopback or private-network targets by using DNS rebinding against two outbound fetch paths that are still not pinned to the validated DNS answer.\n\nThe first path is OpenAPI query import. It validates the supplied hostname with the blacklist and then performs a separate raw fetch. A hostname that resolves to a public address during validation and to `127.0.0.1` during the request is accepted.\n\nThe second path is REST datasource/query execution. It calls the fixed `fetchWithBlacklist()` helper, but provides a custom undici `fetchFn` that installs a `dispatcher`. The helper passes a pinned Node `agent`, but undici uses the dispatcher and resolves the original hostname again at connection time. This defeats the DNS pinning added for the previous outbound fetch advisory.\n\nImpact is authenticated SSRF from the Budibase server process. An attacker with the relevant builder/query privileges can reach loopback or private HTTP services that should be blocked by Budibase's outbound fetch protections, subject to the normal response handling of each feature.\n\n## Reproduction\n\n1. Configure an attacker-controlled hostname so the validation lookup returns a public IP address and the later request lookup returns an internal address such as `127.0.0.1`.\n2. Start a loopback canary HTTP service on the Budibase host.\n3. For OpenAPI query import, submit an import URL such as `http://rebind.test:<port>/openapi.json` through the builder query import endpoints. In a harness matching the current import code, validation resolved `rebind.test` to `8.8.8.8`, the raw fetch then resolved `rebind.test` to `127.0.0.1`, and the loopback canary returned `loopback-canary-hit:/openapi.json`.\n4. For REST datasource/query execution, configure a REST datasource/query URL using the same rebinding hostname. In a harness matching the current helper plus REST undici custom fetch path, a direct loopback URL was blocked and a pinned Node-agent control did not hit loopback, but the REST undici path re-resolved the hostname to `127.0.0.1` and returned `REST-UNDICI-REBIND-CANARY` from the loopback service.\n\nObserved OpenAPI import proof:\n\n```json\n{\n  \"outcome\": \"allowed\",\n  \"body\": \"loopback-canary-hit:/openapi.json\",\n  \"lookups\": [\n    {\"phase\": \"guard\", \"hostname\": \"rebind.test\", \"address\": \"8.8.8.8\"},\n    {\"phase\": \"fetch\", \"hostname\": \"rebind.test\", \"address\": \"127.0.0.1\"}\n  ]\n}\n```\n\nObserved REST undici proof:\n\n```json\n{\n  \"directControl\": {\"outcome\": \"blocked\", \"hitsAfter\": 0},\n  \"pinnedNodeFetchControl\": {\"outcome\": \"no_loopback_hit\", \"hitsAfter\": 0},\n  \"undiciBypass\": {\n    \"outcome\": \"allowed\",\n    \"status\": 200,\n    \"body\": \"REST-UNDICI-REBIND-CANARY\",\n    \"hitsAfter\": 1\n  },\n  \"lookupTrace\": [\n    {\"phase\": \"guard\", \"hostname\": \"rebind.test\", \"address\": \"8.8.8.8\"},\n    {\"phase\": \"fetch\", \"hostname\": \"rebind.test\", \"address\": \"127.0.0.1\"}\n  ]\n}\n```\n\n## Root cause and technical details\n\nThe central helper now resolves and validates the target hostname, then passes a pinned Node `http.Agent` or `https.Agent` to the request. That protects callers whose HTTP client honors the Node `agent` option.\n\nOpenAPI query import does not use that helper. In `packages/server/src/api/controllers/query/import/index.ts`, `assertUrlIsSafe()` calls `blacklist.isBlacklisted(parsed.hostname)`, but `fetchFromUrl()` then calls `fetch(currentUrl, { redirect: \"manual\" })`. That creates a validate-then-fetch gap where DNS can change between the blacklist lookup and the actual connection.\n\nREST datasource/query execution uses the helper but changes the transport semantics. In `packages/server/src/integrations/rest.ts`, `setDispatcher()` creates an undici dispatcher with `getDispatcher({ rejectUnauthorized, url: requestUrl })`, then the custom fetch function calls `fetch(requestUrl, setDispatcher(requestInput, requestUrl))`. In `packages/backend-core/src/utils/outboundFetch.ts`, `fetchWithBlacklist()` passes the pinned Node `agent` to `fetchFn`, but undici fetch uses the supplied `dispatcher` instead. The actual connection performs a second hostname resolution and can be rebound to a blocked address.\n\nCurrent affected code is present in latest `master` and in the latest release tag `3.39.14`.\n\n## Remediation\n\nRoute OpenAPI query import through the pinned outbound fetch helper rather than validating and raw-fetching separately.\n\nMake `fetchWithBlacklist()` pin the actual connection for every supported transport. For undici callers, provide a dispatcher whose lookup or connect behavior is pinned to the validated IP, or reject custom fetch functions that do not explicitly enforce the pinned address. Add regression coverage for direct loopback blocking, DNS rebinding through OpenAPI import, DNS rebinding through REST undici dispatcher, redirect-to-loopback, IPv4-mapped IPv6, and mixed public/private DNS answers.","state":0,"publishedAt":"2026-07-24T21:17:25+00:00","modifiedAt":"2026-08-14T04:12:09.8041422+00:00","affected":[{"ecosystem":"npm","name":"@budibase/server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"3.38.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/Budibase/budibase/security/advisories/GHSA-xg5g-26x8-cvf4","https://github.com/Budibase/budibase/pull/19178","https://github.com/Budibase/budibase/commit/1fecb3fc3497e8db7b60b42cc514ce304ffe3a41","https://github.com/Budibase/budibase/commit/5758bdb242802ca20c4ed0dc579e4330ee898ef3","https://github.com/Budibase/budibase/commit/586802b5706367520d14245e18a7d0cabab0be11","https://github.com/Budibase/budibase","https://github.com/Budibase/budibase/releases/tag/3.39.30"],"sourceUrl":"https://github.com/advisories/GHSA-xg5g-26x8-cvf4","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-xg5g-26x8-cvf4","identifiers":["GHSA-xg5g-26x8-cvf4","CVE-2026-72855"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T18:23:45.7727801+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T18:23:45.7727801+00:00","lastSuccessAt":"2026-11-10T18:23:45.9579119+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.9579152+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-d220ab899e0e1c49e43094274f562c18c4a19b03898aec3feae1debdd31f6756","complete":true,"records":422212,"lastAttemptAt":"2026-11-10T18:21:27.6685178+00:00","lastSuccessAt":"2026-11-10T18:21:27.4920545+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:21:27.6685178+00:00","snapshotPublishedAt":"2026-11-10T17:27:33+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-acbb624a79c244aa868394151a25f053","complete":true,"records":13704,"lastAttemptAt":"2026-11-10T18:24:12.0072206+00:00","lastSuccessAt":"2026-11-10T18:24:12.001+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:24:12.001+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13758,"expectedIdentifiers":13758,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T18:23:45.7727801+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T18:23:45.7727801+00:00","lastSuccessAt":"2026-11-10T18:23:45.9591411+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.9591459+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-4459456b8f8c43778c308d7de0a43211","complete":true,"records":13710,"lastAttemptAt":"2026-11-10T18:24:11.1447617+00:00","lastSuccessAt":"2026-11-10T18:24:11.141+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:24:11.141+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13758,"expectedIdentifiers":13758,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-50a085e5b7a5d1546eabdb7e52fab85d658afa8554d3cf95a0891c49d83f2979","complete":true,"records":9935,"lastAttemptAt":"2026-11-10T18:23:45.7142755+00:00","lastSuccessAt":"2026-11-10T16:25:20.0114252+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.7142755+00:00","snapshotPublishedAt":"2026-11-10T16:18:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T18:21:27.7170016+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:21:27.7170016+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-df497239f2f75af38e095cb498791dad4044a8a9a7f5f0ee6008bb732579ab9d","complete":true,"records":3081,"lastAttemptAt":"2026-11-10T18:23:45.7340645+00:00","lastSuccessAt":"2026-11-10T14:21:34.3717399+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.7340645+00:00","snapshotPublishedAt":"2026-11-10T14:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-5bab1d7e68ac802e78d67f5b951f7bcace0c45048e98b39b73b18376172e4b36","complete":true,"records":231619,"lastAttemptAt":"2026-11-10T18:23:45.5819776+00:00","lastSuccessAt":"2026-11-10T18:23:44.1117746+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.5819776+00:00","snapshotPublishedAt":"2026-11-10T17:33:21+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}