CVE-2026-73410 Budibase: SSRF via DNS rebinding in the REST datasource integration

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resol...

CVE-2026-73410

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:06+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-v42f-v8xc-j435...