CVE-2026-73410: Budibase: SSRF via DNS rebinding in the REST datasource integration
Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resolve the hostname again. A builder could use DNS rebinding to make packages/server/src/integrations/rest.ts connect to an internal address after a public address passed validation, with full response access and arbitrary REST methods. The fix adds createPinnedLookup support to the undici dispatcher and passes the validated address to custom fetch implementations. This issue is fixed in version 3.40.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.40.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73410?
The severity of CVE-2026-73410 is rated high with a CVSS score of 8.5.
What is the risk associated with CVE-2026-73410?
The risk associated with CVE-2026-73410 is classified as 73.
How do I fix CVE-2026-73410?
To fix CVE-2026-73410, upgrade Budibase to version 3.40.0 or later, where the issue has been addressed.
What type of vulnerability is CVE-2026-73410?
CVE-2026-73410 is categorized as a Server-Side Request Forgery (SSRF) vulnerability.
Is CVE-2026-73410 relevant to all Budibase versions?
CVE-2026-73410 primarily affects Budibase versions prior to 3.40.0.