CVE-2026-54353

Budibase is an open-source low-code platform. Prior to 3.39.9, authenticated users with automation permissions can bypass Budibase's SSRF blacklist through DNS rebinding. The outbound fetch flow validates a hostname against the blacklist before the request is sent, but the actual socket connection later performs a separate DNS lookup through node-fetch. Since the validated IPs are never pinned to the connection, an attacker-controlled hostname can return a public IP during validation and a private/internal IP during the real connection. This results in a non-blind SSRF primitive against internal services reachable from the Budibase host, including loopback, RFC1918 ranges, and cloud metadata endpoints. This vulnerability is fixed in 3.39.9.

• CWE-367
• CWE-918

• https://github.com/Budibase/budibase/security/advisories/GHSA-gfq7-5x4g-3xhfExploit, Vendor Advisory
• https://github.com/Budibase/budibase/security/advisories/GHSA-gfq7-5x4g-3xhfExploit, Vendor Advisory

Published

Jun 26, 2026

Last Modified

Jun 30, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54344ToolJet is an open-source low-code platform for building int…4.7
• CVE-2026-54345gopacket provides packet processing capabilities for Go. In …7.5
• CVE-2026-5435The deprecated functions ns_printrrf, ns_printrr and fp_nque…7.3
• CVE-2026-54350Budibase is an open-source low-code platform. Prior to 3.39.…9.8
• CVE-2026-54351Budibase is an open-source low-code platform. Prior to 3.39.…9.6
• CVE-2026-54352Budibase is an open-source low-code platform. Prior to 3.39.…9.6
• CVE-2026-54357An improper authorization vulnerability in MISP allowed an a…5.1
• CVE-2026-54358An incorrect authorization vulnerability in MISP allows an o…7.5
• CVE-2026-54359MISP contains an insecure default configuration in which the…7.1
• CVE-2026-5436The MW WP Form plugin for WordPress is vulnerable to Arbitra…8.1
• CVE-2026-54360A mass assignment vulnerability exists in MISP’s sharing gro…8.4
• CVE-2026-54361MISP contained multiple mass assignment vulnerabilities in t…8.8