PT-2026-51462 · Budibase · Budibase
Published
2026-06-22
·
Updated
2026-06-26
·
CVE-2026-54353
CVSS v3.1
8.5
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Budibase versions prior to 3.39.9
Description
Authenticated users with automation permissions can bypass the Server-Side Request Forgery (SSRF) blacklist through DNS rebinding. This occurs because the outbound fetch flow resolves the DNS twice: once during blacklist validation and again during the actual socket connection via
node-fetch. Since the validated IP addresses are not pinned to the connection, an attacker-controlled hostname can return a public IP during validation and a private or internal IP during the actual connection. This creates a Time-of-Check to Time-of-Use (TOCTOU) condition, resulting in a non-blind SSRF primitive against internal services reachable from the host, including loopback, RFC1918 ranges, and cloud metadata endpoints. The issue affects several components, including outgoing webhooks and integrations with Slack, Discord, Make, Zapier, n8n, AI extract, and object-store fetches. On cloud deployments without IMDSv2 enforcement, this could expose temporary IAM credentials.Recommendations
Update Budibase to version 3.39.9.
Fix
SSRF
Time Of Check To Time Of Use
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Budibase