CVE-2026-72855 is a server-side request forgery vulnerability in Budibase server before version 3.40.0. The vulnerability exists in the OpenAPI query import and REST query execution components, where authenticated builder-level users can bypass DNS pinning protections through DNS rebinding attacks. This allows attackers to configure hostnames that initially resolve to public addresses during validation but later resolve to loopback or private addresses during connection, enabling access to internal HTTP services that are normally blocked.

An attacker with authenticated builder-level access can exploit this vulnerability to bypass DNS pinning protections and perform DNS rebinding attacks. This can lead to unauthorized access to internal HTTP services that are intended to be inaccessible, potentially exposing sensitive internal resources or data. The CVSS 4.0 score of 8.4 indicates a high severity impact with network attack vector, low attack complexity, and high impact on confidentiality and system components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated in the provided data, users should monitor Budibase vendor advisories for updates. In the meantime, restrict builder-level user privileges and monitor for suspicious query imports or REST query executions that could indicate exploitation attempts.