{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.38.1"}],"component":"@budibase/server","cve_ids":["CVE-2026-72855"],"ecosystem":"npm","epss":0.00375,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-xg5g-26x8-cvf4","id":"tcs_01M5KGHXG836197VJRKWVS3TTR","modified_at":"2026-08-14T04:12:09.804142197Z","published_at":"2026-07-24T21:17:25Z","references":["https://osv.dev/vulnerability/GHSA-xg5g-26x8-cvf4","https://github.com/Budibase/budibase/security/advisories/GHSA-xg5g-26x8-cvf4","https://github.com/Budibase/budibase/pull/19178","https://github.com/Budibase/budibase/commit/1fecb3fc3497e8db7b60b42cc514ce304ffe3a41","https://github.com/Budibase/budibase/commit/5758bdb242802ca20c4ed0dc579e4330ee898ef3","https://github.com/Budibase/budibase/commit/586802b5706367520d14245e18a7d0cabab0be11","https://github.com/Budibase/budibase","https://github.com/Budibase/budibase/releases/tag/3.39.30"],"severity":{"label":"high","score":8.5},"sources":[{"source":"osv","source_id":"GHSA-xg5g-26x8-cvf4","url":"https://osv.dev/vulnerability/GHSA-xg5g-26x8-cvf4"}],"summary":"Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution"}