CVE-2026-73410

Received Received - Intake

Outbound Fetch DNS Rebinding in Budibase

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resolve the hostname again. A builder could use DNS rebinding to make packages/server/src/integrations/rest.ts connect to an internal address after a public address passed validation, with full response access and arbitrary REST methods. The fix adds createPinnedLookup support to the undici dispatcher and passes the validated address to custom fetch implementations. This issue is fixed in version 3.40.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-73410

Affected Vendors & Products

Vendor	Product	Version / Range
budibase	budibase	3.40.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability in Budibase versions before 3.40.0 allows a builder to bypass address validation via DNS rebinding. The REST integration ignored a pinned Node agent, causing undici to resolve hostnames again. This lets an attacker make the system connect to internal addresses after a public address was validated, gaining full response access and arbitrary REST methods.

Detection Guidance

This vulnerability involves DNS rebinding attacks where an attacker manipulates DNS resolution to bypass network restrictions. To detect it, monitor outbound requests to internal addresses from unexpected sources, check for unusual DNS query patterns, and inspect logs for connections to validated but later rebinded addresses. Use network monitoring tools like tcpdump or Wireshark to capture and analyze DNS and HTTP traffic for anomalies.

Impact Analysis

An attacker could exploit this to access internal systems, steal sensitive data, or perform unauthorized actions through the REST integration. This includes reading internal responses and executing arbitrary methods on internal services.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using affected versions may face compliance violations and potential penalties.

Mitigation Strategies

Upgrade Budibase to version 3.40.0 or later to apply the fix. If upgrading is not immediately possible, restrict outbound network access to trusted addresses, implement DNS pinning or validation mechanisms, and monitor for suspicious DNS rebinding attempts. Disable or restrict REST integrations until the update is applied.

Hi! I’m here to help you understand CVE-2026-73410. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70