CVE-2026-72855 is a server-side request forgery vulnerability in Budibase server before version 3.40.0. The vulnerability exists in the handling of OpenAPI query import and REST query execution, where authenticated users with builder-level privileges can bypass DNS pinning protections through DNS rebinding attacks. By manipulating DNS resolution, attackers can cause hostnames to resolve to public addresses during validation and to internal or loopback addresses during connection, thereby gaining unauthorized access to internal HTTP services that are normally inaccessible.

An authenticated builder-level user can exploit this vulnerability to bypass DNS pinning protections and access internal HTTP services that are intended to be blocked. This could lead to unauthorized internal network access and potential exposure of sensitive internal resources. The CVSS 4.0 base score is 8.4, indicating a high severity vulnerability with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Until a patch is available, restrict builder-level user privileges and monitor for suspicious activity related to OpenAPI query imports and REST query executions.