Server-Side Request Forgery Vulnerabilities in Budibase by Budibase

CVE-2026-72855

What is CVE-2026-72855?

Budibase prior to version 3.40.0 has vulnerabilities that enable server-side request forgery (SSRF) through its OpenAPI query imports and REST query execution features. Authenticated builder-level users can exploit these vulnerabilities to bypass DNS pinning protections via DNS rebinding attacks. This allows attackers to set hostnames that resolve to public addresses during the validation phase while resolving to private or loopback addresses during the actual connection, thereby gaining unauthorized access to restricted internal HTTP services.

References