CVE-2026-73410: 
JavaScript vulnerability analysis and mitigation

CVE-2026-73410 is a Server-Side Request Forgery (SSRF) via DNS rebinding vulnerability in Budibase, an open-source low-code platform. It affects all versions prior to 3.40.0 of the @budibase/server npm package. The vulnerability was published on August 17, 2026, with the fix released in version 3.40.0. It carries a CVSS v3.1 base score of 8.5 (High) (GitHub Advisory).

The root cause is a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) combined with SSRF (CWE-918). Budibase's outbound fetch guard (fetchWithBlacklist in outboundFetch.ts) resolves a target hostname, validates all resolved IPs against a blacklist, and pins the connection to the validated IP via a Node.js http(s).Agent. However, the REST datasource integration (rest.ts) overrides the fetch transport with undici's fetch, passing a custom dispatcher via getDispatcher. Because undici silently ignores the Node agent option and uses only its dispatcher, it independently re-resolves the hostname's DNS at connection time — bypassing the IP pin entirely. An attacker exploiting DNS rebinding (TTL=0 domain returning a safe public IP during validation, then an internal IP at connect time) can cause the server to issue arbitrary HTTP requests to internal services, with full response body returned to the caller. This bypass is specific to the REST datasource path, as it is the only caller that overrides fetchFn with undici; all other outbound paths use node-fetch and correctly honor the pinned agent (GitHub Advisory, Fix Commit).

A successful exploit allows an authenticated builder or tenant to make the Budibase server issue arbitrary HTTP requests (with any method, headers, and body) to internal-only services, receiving the full response. In multi-tenant or cloud-hosted deployments, this can lead to theft of cloud IAM credentials via the metadata endpoint (http://169.254.169.254/), unauthorized read access to internal CouchDB, Redis, or MinIO instances (exposing all tenants' apps, users, and secrets), and integrity/availability loss through arbitrary write or delete operations against unauthenticated localhost services such as CouchDB on port 5984 (GitHub Advisory).

No public proof-of-concept exploit or active in-the-wild exploitation has been observed as of the disclosure date, though the advisory includes a detailed PoC harness demonstrating the bypass (GitHub Advisory). The vulnerability requires an authenticated account with builder or tenant privileges and the ability to configure and trigger a REST datasource, making it non-trivially automatable (SSVC: automatable = no). The EPSS score is approximately 0.0017 (0.17%), indicating low near-term exploitation probability. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The attack complexity is rated High due to the DNS rebinding requirement, though TTL-0 rebinding frameworks can reduce this barrier in practice.

1. Obtain authenticated access: Acquire a Budibase account with builder or tenant privileges that can configure and execute REST datasource queries.
2. Set up a DNS rebinding domain: Register or control a domain with a TTL-0 DNS record. Configure it to return a safe, non-blacklisted public IP (e.g., 203.0.113.10) during the initial validation lookup, and an internal target IP (e.g., 127.0.0.1, 169.254.169.254, or an internal CouchDB/Redis address) at connection time.
3. Configure a REST datasource: In the Budibase builder UI, create a new REST datasource pointing to the attacker-controlled rebinding domain (e.g., http://rebind.attacker.com/).
4. Trigger the datasource query: Execute a REST datasource query. Budibase's fetchWithBlacklist resolves the hostname, observes the safe public IP, and passes validation. The undici dispatcher then independently re-resolves the hostname, receiving the internal IP.
5. Receive internal response: The undici transport connects to the internal service (e.g., cloud metadata endpoint or CouchDB). The full HTTP response body is returned to the attacker through the REST datasource result.
6. Escalate: Use arbitrary HTTP methods (PUT/POST/DELETE) with custom bodies to write or delete data on unauthenticated internal services, or extract IAM credentials from cloud metadata for further cloud account compromise (GitHub Advisory).

• Network: Outbound HTTP requests from the Budibase server to cloud metadata endpoints (e.g., 169.254.169.254) or internal service addresses (e.g., 127.0.0.1:5984 for CouchDB, 127.0.0.1:6379 for Redis); DNS queries for attacker-controlled domains with TTL=0 from the Budibase server.
• Logs: Budibase server logs showing REST datasource queries targeting unusual or external hostnames that resolve to internal IP ranges; repeated DNS resolution events for the same hostname returning different IPs in short succession.
• Application Behavior: REST datasource responses containing internal service data (e.g., CouchDB database listings, cloud IAM credential JSON, Redis responses); unexpected PUT/POST/DELETE requests logged by internal services originating from the Budibase server process.

Upgrade Budibase to version 3.40.0 or later, which resolves the issue by exporting a createPinnedLookup function and passing the validated pinnedIp to custom fetch implementations (including undici dispatchers), ensuring the pinned IP is enforced at the transport layer regardless of which HTTP client is used (Fix Commit). As interim mitigations for deployments that cannot immediately upgrade: restrict network egress from the Budibase server to block access to internal IP ranges and cloud metadata endpoints at the firewall or network policy level; limit builder/tenant privileges to trusted users only; and monitor DNS resolution patterns for TTL-0 domains or rapid IP changes on outbound requests (GitHub Advisory).

The vulnerability was reported by security researcher dhairya7760 and published by Budibase maintainer mjashanks via GitHub Security Advisories on July 22, 2026. The advisory provides an unusually detailed technical write-up including a self-contained PoC harness and a thorough CVSS justification, reflecting a high level of transparency from the Budibase team. No significant broader media coverage or notable social media discussion has been identified beyond the advisory itself (GitHub Advisory).