CVE-2026-54353 Details
Description
Budibase is an open-source low-code platform. Prior to 3.39.9, authenticated users with automation permissions can bypass Budibase's SSRF blacklist through DNS rebinding. The outbound fetch flow validates a hostname against the blacklist before the request is sent, but the actual socket connection later performs a separate DNS lookup through node-fetch. Since the validated IPs are never pinned to the connection, an attacker-controlled hostname can return a public IP during validation and a private/internal IP during the real connection. This results in a non-blind SSRF primitive against internal services reachable from the Budibase host, including loopback, RFC1918 ranges, and cloud metadata endpoints. This vulnerability is fixed in 3.39.9.
A server-side request forgery (SSRF) vulnerability has been identified in Budibase, an open-source low-code platform, in versions prior to 3.39.9. The issue allows authenticated users with automation permissions to bypass Budibase's SSRF blacklist through DNS rebinding. The vulnerability arises because the outbound fetch process validates hostnames against a blacklist before sending requests, but the actual socket connection performs a separate DNS lookup that can be manipulated. This flaw creates a non-blind SSRF vulnerability, allowing access to internal services from the Budibase host, including loopback addresses, private IP ranges, and cloud metadata endpoints.
Users can update to Budibase version 3.39.9 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Budibase/budibase/security/advisories/GHSA-gfq7-5x4g-3xhf | CISA-ADP | ExploitVendor Advisory |
| https://github.com/Budibase/budibase/security/advisories/GHSA-gfq7-5x4g-3xhf | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| budibase budibase | < 3.39.9 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 30, 2026 | Initial Analysis | [email protected] |
| Jun 29, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |