CVE-2026-54353: Budibase DNS Rebinding SSRF Vulnerability – Patch 3.39.9

Technical summary

The vulnerability stems from a logic gap in how Budibase's outbound fetch automation validates URLs. The validation layer checks the hostname/resolved IP against a blacklist of restricted ranges (loopback, RFC1918 private ranges, and cloud metadata endpoints). However, this validation happens before the actual HTTP request, while the underlying node-fetch library performs its own independent DNS resolution at socket-connection time. By controlling a domain name and manipulating its DNS responses—returning different IPs during the validation window versus the connection window—an attacker can bypass the blacklist. The attacker gains non-blind SSRF capabilities, meaning they can read responses from internal services, extract data from cloud metadata endpoints, or pivot to backend systems. The vulnerability chain involves CWE-367 (Time-of-check-time-of-use) and CWE-918 (Server-Side Request Forgery), reflecting both the TOCTOU flaw and the ultimate impact.

Business impact

Organizations running Budibase in environments where internal services (databases, APIs, cloud metadata endpoints, monitoring systems) are accessible from the Budibase host face significant risk. An attacker with automation permissions—which may be granted to trusted partners, contractors, or junior team members—can exfiltrate sensitive data without direct database access. Cloud-hosted deployments are particularly at risk if metadata endpoints (AWS, GCP, Azure) are accessible; compromised credentials or role tokens could lead to broader cloud account compromise. The impact extends beyond data theft to lateral movement, reconnaissance of the internal network topology, and potential denial-of-service attacks against critical internal services. Organizations should evaluate who holds automation permissions and what internal services are reachable from their Budibase instances.

Affected systems

Budibase versions prior to 3.39.9 are affected. The vulnerability requires that the attacker possess authenticated access with automation permissions, so it is not a zero-day threat to unauthenticated instances. Self-hosted Budibase deployments are at risk if they can reach internal networks from the application server. Cloud-hosted Budibase instances may be affected depending on network isolation and whether cloud metadata endpoints are accessible. Organizations using Budibase for low-code automation that connects to external APIs or services in a shared-tenancy or network-restricted environment should prioritize assessment.

Exploitability

Exploitation requires valid Budibase credentials and the automation permission role. No user interaction or special configuration is needed beyond that. The attack is straightforward: an attacker with these permissions can create an automation workflow that triggers an outbound fetch to an attacker-controlled domain. By serving different DNS responses based on timing or source IP, the attacker can craft requests to internal services. The CVSS score of 8.5 (HIGH) reflects network accessibility and the need for authentication, but also the high impact of unauthorized disclosure and limited system integrity changes. The vulnerability does not appear to be actively exploited in the wild (KEV status: not listed), but the low barrier to exploitation for authenticated users means patch deployment should not be delayed.

Remediation

Upgrade to Budibase version 3.39.9 or later, which implements proper hostname validation that is honored through the actual connection. The patch ensures that DNS resolution results are validated and pinned, preventing DNS rebinding attacks. Organizations should prioritize this upgrade in environments where Budibase has network access to internal systems. Additionally, apply the principle of least privilege: audit which users and service accounts hold automation permissions, and restrict those permissions to only those who require them. Implement network segmentation where possible to limit Budibase's access to internal services. Consider disabling outbound fetch automation if not actively used.

Patch guidance

Apply Budibase 3.39.9 or any subsequent release. Verify the patch through the official Budibase release notes and downloads. If you are using a package manager (npm, Docker) to deploy Budibase, update your dependency or container image tag to the fixed version. Test the upgrade in a non-production environment first to ensure compatibility with your automations and integrations. No breaking changes are documented for this patch, but review any custom automation workflows that perform outbound fetches to confirm they continue to function as expected.

Detection guidance

Monitor outbound network connections from Budibase instances to internal IP ranges (127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254 for AWS, 169.254.169.254 for GCP, etc.). Review automation workflow audit logs for any fetch operations to domains with unusual DNS resolution patterns or repeated failed connection attempts followed by successful internal connections. Network-level IDS/IPS rules can be tuned to flag SSRF-like patterns: requests to automation endpoints followed by suspicious outbound connections. Assess user accounts with automation permissions and correlate any suspicious permission assignments with recent network anomalies.

Why prioritize this

This vulnerability merits immediate attention due to its combination of factors: high CVSS score (8.5), clear attack chain with low exploitation complexity for authenticated users, potential for data exfiltration from internal systems and cloud metadata, and broad applicability across self-hosted and cloud deployments. Although it requires authentication, the permissions required (automation) may be held by non-security personnel, increasing the attack surface. Organizations with Budibase in cloud environments or network-sensitive deployments should prioritize patching within days, not weeks. The lack of active exploitation (KEV status: not listed) provides a narrow window to patch before threat actors develop weaponized exploits.

Risk score, explained

CVSS 8.5 (HIGH) is justified by: (1) Network-accessible attack vector (Budibase must be reachable, though typically internal), (2) Low attack complexity—DNS rebinding requires only attacker control of a domain, (3) Requirement for authentication and the automation permission role (lowers from CRITICAL), (4) Confidentiality impact rated HIGH due to non-blind SSRF enabling data exfiltration from internal services, (5) Integrity impact rated LOW due to limited ability to modify data on internal systems via SSRF, (6) No availability impact (Availability: N). The score does not account for active exploitation, but the time-to-exploit is short once detailed information is public.

Frequently asked questions