Budibase SSRF blacklist bypass via DNS rebinding

CVE-2026-54353 is a server-side request forgery vulnerability in Budibase, an open-source low-code platform, affecting versions prior to 3.39.9. In the outbound fetch flow, Budibase validates the supplied hostname against an SSRF blacklist before sending the request, but the actual network connection later performs a separate DNS resolution through node-fetch. Because the IP address validated during the initial check is not pinned to the subsequent socket connection, an attacker-controlled hostname can resolve to a benign public IP during validation and then re-resolve to a private or internal IP when the real connection is made. This DNS rebinding condition creates a TOCTOU-style blacklist bypass and yields a non-blind SSRF primitive from the Budibase host to internal services, including loopback, RFC1918 space, and cloud metadata endpoints.