{"cve":"CVE-2026-72855","nvd":{"published":"2026-08-13T22:17:24.753","modified":"2026-10-08T16:17:37.090","status":"Deferred","description":"Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public addresses during validation but resolve to loopback or private addresses during actual connection, allowing access to blocked internal HTTP services.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","score":8.4},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","score":8.5},"cwes":["CWE-918"],"references":["https://github.com/Budibase/budibase/security/advisories/GHSA-xg5g-26x8-cvf4","https://www.vulncheck.com/advisories/budibase-before-dns-rebinding-ssrf-via-openapi-and-rest"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:48:17.459049833+00:00"},"epss":{"cve":"CVE-2026-72855","score":0.00375,"percentile":0.31178,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-xg5g-26x8-cvf4","url":"https://osv.dev/vulnerability/GHSA-xg5g-26x8-cvf4","summary":" Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution","modified":"2026-08-14T04:12:09.804142197Z","packages":[{"ecosystem":"npm","name":"@budibase/server","purl":"pkg:npm/%40budibase/server","ranges":["<=3.38.1"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}