CVE-2026-72855 budibase CVE debrief

Who should care

Budibase users and administrators, security teams monitoring for server-side request forgery vulnerabilities, and organizations using Budibase for internal HTTP services should be aware of this vulnerability. The vulnerability affects Budibase versions before 3.40.0 and allows authenticated builder-level users to bypass DNS pinning protections. Security teams should review the official CVE record and vendor guidance to determine the affected scope and severity. Additionally, security teams should monitor for potential DNS rebinding attacks and implement compensating controls to block suspicious internal HTTP requests. Budibase users and administrators should prioritize patching or mitigating the vulnerability to prevent potential attacks. Security teams should also review their asset inventory and verify the affected scope to ensure that all affected systems are addressed. Furthermore, security teams should consider implementing additional security controls, such as monitoring and detection, to identify and respond to potential attacks. Finally, security teams should track exceptions and retest remediated assets to ensure that the vulnerability is fully addressed. IT teams responsible for Budibase deployments should coordinate with security teams to prioritize and apply vendor remediation. Budibase users with builder-level access should be aware of the potential risks and take steps to limit their exposure. Security teams should also consider implementing rollback/change windows to ensure that all changes are properly tested and validated. By taking these steps, organizations can reduce the risk of exploitation and protect their internal HTTP services. Budibase users and administrators should also review their system configurations and ensure that they are not using vulnerable versions of Budibase. Additionally, security teams should consider implementing source tracking to monitor for potential attacks and identify areas for improvement. By prioritizing patching and mitigation, organizations can minimize the risk of exploitation and protect their internal HTTP services. Budibase users and administrators should also consider implementing compensating controls,

Technical summary

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. The vulnerabilities are caused by inadequate validation of hostname resolutions during the connection process. Attackers can configure hostnames that resolve to public addresses during validation but resolve to loopback or private addresses during actual connection, allowing access to blocked internal HTTP services. The Budibase security advisory provides additional technical details on the vulnerability and recommended mitigations.

Defensive priority

Authenticated users with builder-level access could exploit Budibase's server-side request forgery vulnerabilities to bypass DNS pinning protections and access blocked internal HTTP services.

Recommended defensive actions

• Inventory and verify Budibase installations for version 3.40.0 or later
• Restrict access to OpenAPI query import and REST query execution features
• Implement compensating controls to monitor and block suspicious internal HTTP requests
• Monitor for and respond to potential DNS rebinding attacks
• Apply vendor remediation when available

Evidence notes

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution. Attackers can configure hostnames that resolve to public addresses during validation but resolve to loopback or private addresses during actual connection. The Budibase security advisory provides additional context on the vulnerability and recommended mitigations. However, the advisory does not provide specific details on the affected products or components. Defenders should verify the affected scope and severity based on the official CVE record and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.