Budibase's outbound fetch guard uses IP pinning via a Node http(s).Agent to prevent SSRF and DNS rebinding by validating and pinning the resolved IP address. However, the REST datasource integration overrides the fetch function with undici's fetch, which ignores the Node agent and instead uses its own dispatcher that re-resolves DNS at connection time without IP pinning. This allows an attacker controlling a rebinding hostname to cause the server to connect to internal IPs despite validation passing on a safe public IP. The vulnerability enables full-response SSRF with arbitrary HTTP methods and bodies, allowing reading and writing to internal services such as cloud metadata endpoints and internal databases. Other outbound paths in Budibase continue to use the pinned Node agent and are not affected.

An authenticated user with permission to configure and run REST datasources can exploit this vulnerability to perform SSRF attacks that bypass DNS rebinding protections. This enables unauthorized access to internal-only services, including cloud metadata services (risking credential theft), internal databases (CouchDB, Redis, MinIO), and other internal endpoints. The attacker can read sensitive data and potentially modify or destroy internal data due to the ability to use arbitrary HTTP methods and request bodies. This compromises confidentiality, integrity, and availability of internal resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to REST datasource configuration to fully trusted users only. Monitor for unusual internal service access patterns initiated via REST datasources. Avoid using untrusted hostnames in REST datasource configurations. Follow Budibase vendor advisories for updates and apply official patches once available.