CVE-2026-72855

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.40.0

Description Server-side request forgery exists in the OpenAPI query import and REST query execution. Authenticated builder-level users can bypass DNS pinning protections using DNS rebinding attacks. This technique involves configuring hostnames that resolve to public addresses during the validation phase but resolve to loopback or private addresses during the actual connection, enabling unauthorized access to blocked internal HTTP services.

Recommendations Update Budibase to version 3.40.0 or later.