Summary
Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution
Reproduction
- Configure an attacker-controlled hostname so the validation lookup returns a public IP address and the later request lookup returns an internal address such as
127.0.0.1. - Start a loopback canary HTTP service on the Budibase host.
- For OpenAPI query import, submit an import URL such as
http://rebind.test:<port>/openapi.jsonthrough the builder query import endpoints. In a harness matching the current import code, validation resolvedrebind.testto8.8.8.8, the raw fetch then resolvedrebind.testto127.0.0.1, and the loopback canary returnedloopback-canary-hit:/openapi.json. - For REST datasource/query execution, configure a REST datasource/query URL using the same rebinding hostname. In a harness matching the current helper plus REST undici custom fetch path, a direct loopback URL was blocked and a pinned Node-agent control did not hit loopback, but the REST undici path re-resolved the hostname to
127.0.0.1and returnedREST-UNDICI-REBIND-CANARYfrom the loopback service.
Observed OpenAPI import proof:
{
"outcome": "allowed",
"body": "loopback-canary-hit:/openapi.json",
"lookups": [
{"phase": "guard", "hostname": "rebind.test", "address": "8.8.8.8"},
{"phase": "fetch", "hostname": "rebind.test", "address": "127.0.0.1"}
]
}
Observed REST undici proof:
{
"directControl": {"outcome": "blocked", "hitsAfter": 0},
"pinnedNodeFetchControl": {"outcome": "no_loopback_hit", "hitsAfter": 0},
"undiciBypass": {
"outcome": "allowed",
"status": 200,
"body": "REST-UNDICI-REBIND-CANARY",
"hitsAfter": 1
},
"lookupTrace": [
{"phase": "guard", "hostname": "rebind.test", "address": "8.8.8.8"},
{"phase": "fetch", "hostname": "rebind.test", "address": "127.0.0.1"}
]
}
Root cause and technical details
The central helper now resolves and validates the target hostname, then passes a pinned Node http.Agent or https.Agent to the request. That protects callers whose HTTP client honors the Node agent option.
OpenAPI query import does not use that helper. In packages/server/src/api/controllers/query/import/index.ts, assertUrlIsSafe() calls blacklist.isBlacklisted(parsed.hostname), but fetchFromUrl() then calls fetch(currentUrl, { redirect: "manual" }). That creates a validate-then-fetch gap where DNS can change between the blacklist lookup and the actual connection.
REST datasource/query execution uses the helper but changes the transport semantics. In packages/server/src/integrations/rest.ts, setDispatcher() creates an undici dispatcher with getDispatcher({ rejectUnauthorized, url: requestUrl }), then the custom fetch function calls fetch(requestUrl, setDispatcher(requestInput, requestUrl)). In packages/backend-core/src/utils/outboundFetch.ts, fetchWithBlacklist() passes the pinned Node agent to fetchFn, but undici fetch uses the supplied dispatcher instead. The actual connection performs a second hostname resolution and can be rebound to a blocked address.
Current affected code is present in latest master and in the latest release tag 3.39.14.
Impact
A builder-level user can make Budibase issue server-side HTTP requests to loopback or private-network targets by using DNS rebinding against two outbound fetch paths that are still not pinned to the validated DNS answer.
The first path is OpenAPI query import. It validates the supplied hostname with the blacklist and then performs a separate raw fetch. A hostname that resolves to a public address during validation and to 127.0.0.1 during the request is accepted.
The second path is REST datasource/query execution. It calls the fixed fetchWithBlacklist() helper, but provides a custom undici fetchFn that installs a dispatcher. The helper passes a pinned Node agent, but undici uses the dispatcher and resolves the original hostname again at connection time. This defeats the DNS pinning added for the previous outbound fetch advisory.
Impact is authenticated SSRF from the Budibase server process. An attacker with the relevant builder/query privileges can reach loopback or private HTTP services that should be blocked by Budibase's outbound fetch protections, subject to the normal response handling of each feature.
Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside. Typical impact: access to internal metadata services, internal APIs, or cloud credentials.
GHSA-XG5G-26X8-CVF4 has a CVSS score of 8.5 (High). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. No fixed version is listed yet, so configuration controls and monitoring matter more in the interim.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Route OpenAPI query import through the pinned outbound fetch helper rather than validating and raw-fetching separately.
Make fetchWithBlacklist() pin the actual connection for every supported transport. For undici callers, provide a dispatcher whose lookup or connect behavior is pinned to the validated IP, or reject custom fetch functions that do not explicitly enforce the pinned address. Add regression coverage for direct loopback blocking, DNS rebinding through OpenAPI import, DNS rebinding through REST undici dispatcher, redirect-to-loopback, IPv4-mapped IPv6, and mixed public/private DNS answers.
Frequently Asked Questions
- What is GHSA-XG5G-26X8-CVF4? GHSA-XG5G-26X8-CVF4 is a high-severity server-side request forgery (SSRF) vulnerability in @budibase/server (npm), affecting versions <= 3.38.1. No fixed version is listed yet. Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside.
- How severe is GHSA-XG5G-26X8-CVF4? GHSA-XG5G-26X8-CVF4 has a CVSS score of 8.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of @budibase/server are affected by GHSA-XG5G-26X8-CVF4? @budibase/server (npm) versions <= 3.38.1 is affected.
- Is there a fix for GHSA-XG5G-26X8-CVF4? No fixed version is listed for GHSA-XG5G-26X8-CVF4 yet. Monitor the advisory for updates and apply mitigations in the interim.
- Is GHSA-XG5G-26X8-CVF4 exploitable, and should I be worried? Whether GHSA-XG5G-26X8-CVF4 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-XG5G-26X8-CVF4 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-XG5G-26X8-CVF4? No fixed version is listed yet. In the interim: Validate and restrict destination URLs against an allowlist. Block requests to private IP ranges and cloud metadata endpoints.