CVE-2026-73410: 
JavaScript vulnerability analysis and mitigation

CVE-2026-73410 is a Server-Side Request Forgery (SSRF) vulnerability via DNS rebinding in Budibase's REST datasource integration. It affects all Budibase versions prior to 3.40.0 and was published on August 17, 2026. The flaw allows an authenticated builder or tenant to bypass the platform's SSRF blacklist by exploiting a TOCTOU race condition between hostname validation and the actual HTTP connection. It carries a CVSS v3.1 base score of 8.5 (High) (GitHub Advisory).

The root cause is a mismatch between Budibase's SSRF guard and the HTTP transport used by the REST datasource integration, classified as CWE-367 (TOCTOU Race Condition) and CWE-918 (SSRF). The central guard (fetchWithBlacklist in outboundFetch.ts) resolves the target hostname, validates all resolved IPs against a blacklist, and pins the connection to the validated IP via a Node.js http(s).Agent. However, rest.ts overrides the fetch function with undici's fetch, passing a custom dispatcher via getDispatcher; undici silently ignores the Node agent option and re-resolves the hostname independently at connect time. An attacker controlling a DNS record with a TTL of 0 can serve a public, non-blacklisted IP during validation and switch to an internal IP (e.g., 127.0.0.1, 169.254.169.254) at connect time, causing the request to reach internal services. A proof-of-concept is included in the advisory demonstrating the bypass using the real, unmodified guard code (GitHub Advisory, Fix Commit).

Successful exploitation grants an authenticated attacker full-response SSRF access to internal services, including cloud metadata endpoints (e.g., http://169.254.169.254/) enabling IAM credential theft and cloud account compromise. Because REST datasources allow arbitrary HTTP methods and request bodies, an attacker can also issue PUT, POST, and DELETE requests against unauthenticated internal services such as CouchDB (port 5984), Redis, and MinIO — enabling creation of admin documents, modification or deletion of tenant databases, and cache flushing. In multi-tenant or cloud-hosted Budibase deployments, this can result in full confidentiality, integrity, and availability loss across all co-tenants (GitHub Advisory).

No public proof-of-concept exploit code has been released beyond the controlled PoC included in the security advisory itself, and no in-the-wild exploitation has been observed as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a low-privilege authenticated account (builder/tenant role) and the ability to configure and trigger a REST datasource, plus control of a DNS record with a TTL-0 rebinding setup, making it High complexity (GitHub Advisory).

1. Obtain authenticated access: Acquire a Budibase builder or tenant account on a target deployment running a version prior to 3.40.0.
2. Set up a DNS rebinding domain: Register or control a domain with a DNS record set to TTL 0. Configure it to return a public, non-blacklisted IP (e.g., 203.0.113.10) on the first query (during validation) and an internal IP (e.g., 127.0.0.1, 169.254.169.254, or internal CouchDB/Redis address) on subsequent queries (at connect time).
3. Configure a REST datasource: In the Budibase builder UI, create or edit a REST datasource pointing to the attacker-controlled rebinding domain (e.g., http://rebind.attacker.com/).
4. Trigger a datasource query: Execute a REST datasource query. The fetchWithBlacklist guard resolves the hostname, sees the public IP, and passes validation. The undici dispatcher then re-resolves the hostname independently and connects to the internal IP.
5. Receive the internal response: The full HTTP response body from the internal service is returned to the attacker through the Budibase REST datasource response. For cloud metadata, this yields IAM credentials; for CouchDB, it yields all tenant data.
6. Escalate with write operations: Use arbitrary HTTP methods (PUT/POST/DELETE) in the REST datasource to write or delete data on unauthenticated internal services, such as creating CouchDB admin documents or flushing Redis caches (GitHub Advisory).

• Network: Outbound HTTP requests from the Budibase server to cloud metadata endpoints (169.254.169.254, fd00:ec2::254) or internal service ports (5984 for CouchDB, 6379 for Redis, 9000 for MinIO); DNS queries for attacker-controlled domains with TTL 0 originating from the Budibase server.
• Logs: Budibase server logs showing REST datasource queries targeting unusual or external hostnames that resolve to RFC1918 or loopback addresses; repeated DNS resolution events for the same hostname in short succession (indicating TTL-0 rebinding).
• Process/Application: Unexpected REST datasource responses containing cloud metadata tokens, CouchDB database listings, or internal service banners visible in Budibase query results or audit logs.
• File System: New or modified CouchDB documents (e.g., admin user documents) or unexpected changes to internal database contents that correlate with REST datasource activity.

Upgrade Budibase to version 3.40.0 or later, which fixes the issue by exporting createPinnedLookup from outboundFetch.ts and passing the validated pinnedIp to custom fetch implementations, allowing the undici dispatcher to be constructed with a pinned DNS lookup that prevents re-resolution (Fix Commit). As a temporary workaround for deployments that cannot immediately upgrade, apply network segmentation to prevent the Budibase server process from reaching cloud metadata endpoints and internal services (CouchDB, Redis, MinIO) via firewall rules. Additionally, restrict builder/tenant permissions to trusted users only, and monitor for anomalous outbound DNS and HTTP traffic from the Budibase server (GitHub Advisory).