CVE-2026-72855
Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST
- State
- Published
- Severity
- 8.4 High
- Published
- Aug 13, 2026
- Updated
- Oct 8, 2026
- Reserved
- Aug 10, 2026
Description
Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public addresses during validation but resolve to loopback or private addresses during actual connection, allowing access to blocked internal HTTP services.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.4 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N | VulnCheck |
| 3.1 | 8.5 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N | VulnCheck |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
serverbudibase |
|
References
- GitHub Security Advisory (GHSA-xg5g-26x8-cvf4)vendor-advisory
- VulnCheck Advisory: Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and RESTthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.