GHSA-xg5g-26x8-cvf4: Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution

A builder-level user can make Budibase issue server-side HTTP requests to loopback or private-network targets by using DNS rebinding against two outbound fetch paths that are still not pinned to the validated DNS answer.

The first path is OpenAPI query import. It validates the supplied hostname with the blacklist and then performs a separate raw fetch. A hostname that resolves to a public address during validation and to 127.0.0.1 during the request is accepted.

The second path is REST datasource/query execution. It calls the fixed fetchWithBlacklist() helper, but provides a custom undici fetchFn that installs a dispatcher. The helper passes a pinned Node agent, but undici uses the dispatcher and resolves the original hostname again at connection time. This defeats the DNS pinning added for the previous outbound fetch advisory.

Impact is authenticated SSRF from the Budibase server process. An attacker with the relevant builder/query privileges can reach loopback or private HTTP services that should be blocked by Budibase’s outbound fetch protections, subject to the normal response handling of each feature.