Server-side Request Forgery (SSRF) Affecting @budibase/backend-core package, versions <3.39.30
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-BUDIBASEBACKENDCORE-18308464
- published25 Jul 2026
- disclosed24 Jul 2026
- creditUnknown
Introduced: 24 Jul 2026
New CVE NOT AVAILABLE CWE-367 (opens in a new tab)How to fix?
Upgrade @budibase/backend-core to version 3.39.30 or higher.
Overview
@budibase/backend-core is a Budibase backend core libraries used in server and worker
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the REST datasource integration due to improper handling of DNS rebinding protections. An attacker can access internal-only services, read sensitive data, or modify and delete internal resources by configuring a REST datasource to use a rebinding hostname that resolves to a safe public IP during validation but to an internal IP at connection time. This allows the attacker to make the server issue arbitrary HTTP requests to internal endpoints, potentially leading to credential theft, data exposure, or service disruption. This is only exploitable if the attacker has an authenticated account with permissions to configure or run a REST datasource.