CVE-2026-73410

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.40.0

Description Budibase is an open-source low-code platform. A flaw in the REST datasource integration allows an authenticated user, such as a builder or tenant, to perform Server-Side Request Forgery (SSRF) via DNS rebinding. While the platform uses a guard function fetchWithBlacklist to validate and pin target hostnames to safe IP addresses using a Node http(s).Agent, the REST integration overrides the transport with the undici library. Because undici ignores the Node agent option and uses its own dispatcher via the getDispatcher() function, it re-resolves the hostname at connection time. This creates a Time-of-Check to Time-of-Use (TOCTOU) condition where a malicious actor can provide a hostname that resolves to a safe public IP during validation but resolves to an internal IP during the actual connection. This allows arbitrary REST methods and full response access to internal services, such as cloud metadata endpoints for IAM credential theft or internal databases like CouchDB, Redis, and MinIO.

Recommendations Update Budibase to version 3.40.0. As a temporary mitigation, restrict the ability of untrusted users to configure or execute REST datasource queries.