CVE-2026-73410High· 8.5▾ Twilight

Budibase is an open-source low-code platform

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score47/ 100 · Moderate

impact 46.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 17, 2026

Updated

Sep 8, 2026

CVSS

8.5

Vendor

—

Product

—

CWE

CWE-367, CWE-918

Depth score

47 · Moderate

EPSS

0.17% · p7

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Sep 8.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 22 days

Aug 17, 2026Published
Disclosed via NVD
Sep 8, 2026Record revised
Last analysed / modified upstream
Sep 8, 2026EPSS first tracked
0.2%

CWE-367 CWE-918 #nvd

Full technical detail▾

Overview

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resolve the hostname again. A builder could use DNS rebinding to make packages/server/src/integrations/rest.ts connect to an internal address after a public address passed validation, with full response access and arbitrary REST methods. The fix adds createPinnedLookup support to the undici dispatcher and passes the validated address to custom fetch implementations. This issue is fixed in version 3.40.0.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed