CVE-2026-54353: Budibase SSRF Vulnerability via DNS Rebinding

CVE-2026-54353 Overview

CVE-2026-54353 is a Server-Side Request Forgery (SSRF) vulnerability in Budibase, an open-source low-code platform. Authenticated users with automation permissions can bypass the SSRF blacklist through DNS rebinding. The outbound fetch flow validates a hostname against the blacklist before sending the request, but the socket connection later performs a separate DNS lookup through node-fetch. Attackers exploit this Time-of-Check Time-of-Use (TOCTOU) gap to reach internal services, including loopback, RFC1918 ranges, and cloud metadata endpoints. Budibase resolved the issue in version 3.39.9.

Critical Impact
Authenticated attackers can pivot from Budibase automations to internal services and cloud metadata endpoints, exposing credentials and internal infrastructure.

Affected Products

Budibase versions prior to 3.39.9
Self-hosted Budibase deployments exposing automation features to authenticated users
Cloud-hosted Budibase environments with reachable internal metadata services

Discovery Timeline

2026-06-26 - CVE-2026-54353 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-54353

Vulnerability Analysis

The flaw is a classic TOCTOU condition classified under [CWE-367]. Budibase's outbound fetch flow validates a target hostname against an SSRF blacklist before the HTTP request is dispatched. This validation resolves the hostname to an IP address and confirms the IP is not in a restricted range. The resolved IP, however, is never pinned to the outbound socket connection.

When node-fetch later opens the actual connection, it performs a second, independent DNS lookup. An attacker controlling the authoritative DNS server for the hostname can return a public IP for the first lookup and a private or internal IP for the second. The result is a non-blind SSRF primitive that returns response content to the attacker.

Root Cause

The root cause is the separation between hostname validation and connection establishment. The blacklist check operates on a resolved IP that is discarded after validation. The subsequent node-fetch call re-resolves the hostname without honoring the validated address, so the two lookups can legitimately return different answers.

Attack Vector

An authenticated user with automation permissions configures an outbound HTTP action targeting an attacker-controlled domain. The domain's DNS server issues responses with very short TTLs, alternating between a public IP that passes the blacklist and an internal IP such as 169.254.169.254, 127.0.0.1, or an RFC1918 address. Because the exploit requires low-TTL DNS timing and authenticated access, attack complexity is elevated, but successful requests can read cloud metadata credentials, query internal admin panels, or reach services behind the network boundary.

No verified public proof-of-concept code is available. Refer to the Budibase GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-54353

Indicators of Compromise

Outbound Budibase automation requests followed by DNS queries with abnormally short TTLs.
Budibase host connections to 169.254.169.254, 127.0.0.0/8, or RFC1918 ranges originating from the automation runtime.
Unexpected access to cloud instance metadata service (IMDS) responses in application or proxy logs.

Detection Strategies

Inspect Budibase automation audit logs for outbound HTTP actions referencing external hostnames with rapidly changing DNS records.
Correlate DNS resolver logs with application egress traffic to identify hostnames resolving to both public and private IPs within short intervals.
Alert on any Budibase-originated traffic destined for link-local, loopback, or private network ranges.

Monitoring Recommendations

Enable egress filtering logs at the network layer for the Budibase host and forward them to a SIEM.
Monitor cloud metadata endpoint access patterns from application workloads.
Track version metadata from Budibase deployments to identify hosts still running versions below 3.39.9.

How to Mitigate CVE-2026-54353

Immediate Actions Required

Upgrade all Budibase instances to version 3.39.9 or later without delay.
Restrict automation permissions to trusted users pending patch deployment.
Block outbound access from the Budibase host to cloud metadata endpoints and internal management IP ranges.

Patch Information

Budibase fixed the vulnerability in version 3.39.9. The fix ensures the validated IP is pinned to the outbound connection so node-fetch does not perform a second, unverified DNS lookup. Review the Budibase GitHub Security Advisory GHSA-gfq7-5x4g-3xhf for release details.

Workarounds

Place Budibase behind an egress proxy that enforces IP-based allowlists independent of DNS resolution.
Disable IMDSv1 on cloud instances and require IMDSv2 with token authentication to reduce metadata exposure.
Use host-level firewall rules to deny outbound traffic from Budibase processes to private and link-local ranges.

bash

# Example iptables egress restriction for the Budibase host
iptables -A OUTPUT -m owner --uid-owner budibase -d 169.254.169.254 -j DROP
iptables -A OUTPUT -m owner --uid-owner budibase -d 127.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner budibase -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner budibase -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner budibase -d 192.168.0.0/16 -j DROP