CVE-2026-72855CWE-918ssrf

CVE-2026-72855

High · published August 14, 2026

CVSS v3.1
8.5
EPSS
0%
Percentile
30.3
In the wild
Unconfirmed
What it is

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public addresses during validation but resolve to loopback or private addresses during actual connection, allowing access to blocked internal HTTP services.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
8.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
EPSS
0.00375 · 30.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-08-14T02:17Z
References (2)
https://github.com/Budibase/budibase/security/advisories/GHSA-xg5g-26x8-cvf4 · [email protected]https://www.vulncheck.com/advisories/budibase-before-dns-rebinding-ssrf-via-openapi-and-rest · [email protected]
EPSS history
Timeline
  • 13 AUG 21:54Z
    Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST
    cvelistv5