---METADATA---
VENDOR: Budibase
PRODUCT: budibase
AFFECTED_VERSIONS: < 3.40.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Budibase is affected by a combination of Time-of-check Time-of-use (TOCTOU) race conditions and Server-Side Request Forgery (SSRF) vulnerabilities.

Executive Summary:
Budibase versions prior to 3.40.0 are vulnerable to race conditions and SSRF, which could allow an authenticated attacker to bypass security controls or perform unauthorized requests.

Vulnerability Details

CVE-ID: CVE-2026-73410

Affected Software: Budibase budibase

Affected Versions: < 3.40.0

Vulnerability: This vulnerability involves a TOCTOU race condition and SSRF flaws that allow an authenticated user to perform unauthorized actions or interact with internal systems. The attack requires low privileges and can lead to significant security bypasses.

Business Impact

The identified vulnerabilities pose a high risk to organizational data and infrastructure. An attacker could potentially leverage SSRF to scan or interact with internal network resources that are otherwise inaccessible from the public internet. Given the CVSS score of 8.5, this issue is critical, as it allows for total technical impact, including data exfiltration or internal service disruption.

Remediation Plan

Immediate Action: Upgrade to Budibase version 3.40.0 or later to apply the necessary security patches.

Proactive Monitoring: Inspect server logs for unusual outbound connection patterns or unexpected internal API access logs that deviate from established baselines.

Compensating Controls: Ensure that the Budibase instance is deployed within a segmented network environment with strict egress filtering to limit the reach of potential SSRF attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the combination of TOCTOU and SSRF, which can be chained to bypass network isolation.

Analyst Recommendation

The severity of this issue necessitates an immediate update to the latest patched version. Administrators should prioritize this deployment to prevent potential exploitation of the platform's internal network access capabilities.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: < 3.39.24
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Budibase is vulnerable to improper privilege management and authorization flaws, allowing authenticated users to perform unauthorized actions within the low-code platform.

Executive Summary:
A high-severity authorization vulnerability in Budibase allows authenticated attackers to bypass security controls and potentially gain unauthorized access to platform resources.

Vulnerability Details

CVE-ID: CVE-2026-73305

Affected Software: Budibase

Affected Versions: < 3.39.24

Vulnerability: This vulnerability involves improper privilege management and missing or incorrect authorization checks (CWE-269, CWE-862, CWE-863). An authenticated attacker can exploit these flaws to perform actions beyond their intended permission level.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized data access, modification of business applications, or full compromise of the platform environment. Given the CVSS score of 8.8, this represents a significant risk to organizational integrity and data confidentiality, as low-code platforms often serve as central hubs for internal workflows and sensitive business logic.

Remediation Plan

Immediate Action: Update all Budibase instances to version 3.39.24 or later to apply the necessary authorization patches.

Proactive Monitoring: Review system access logs for unusual administrative actions or account privilege escalation patterns.

Compensating Controls: Implement strict network segmentation and ensure that the Budibase instance is not exposed directly to the public internet without an authenticated proxy or VPN.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherent to the authorization logic within the server-side components of the application.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention. Administrators must prioritize updating the Budibase platform to version 3.39.24 to resolve the underlying authorization defects and prevent potential exploitation by malicious actors.

---METADATA---
VENDOR: Budibase
PRODUCT: server
AFFECTED_VERSIONS: 3.39.4 up to (excluding) 3.40.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Budibase server is affected by an authorization regression related to S3 presigned URLs, allowing unauthorized access.

Executive Summary:
An authorization regression in Budibase server versions 3.39.4 to 3.40.0 allows authenticated users to bypass security controls.

Vulnerability Details

CVE-ID: CVE-2026-72859

Affected Software: Budibase server

Affected Versions: 3.39.4 up to (excluding) 3.40.0

Vulnerability: This is an incorrect authorization vulnerability (CWE-863) where the application fails to properly validate permissions before granting access to resources via S3 presigned URLs.

Business Impact

The vulnerability allows an authenticated attacker to perform unauthorized actions, potentially compromising the integrity of data stored in S3 buckets. With a CVSS score of 7.7, the risk of unauthorized data modification or access is significant for business operations relying on Budibase.

Remediation Plan

Immediate Action: Upgrade to Budibase server version 3.40.0 or later to resolve the authorization regression.

Proactive Monitoring: Review access logs for unusual patterns of S3 resource access that deviate from normal user workflow behavior.

Compensating Controls: Temporarily restrict access to S3-related features if upgrading is not immediately possible, or implement strict IAM policies on the S3 buckets to limit accessible scope.

Exploitation Status

Public Exploit Available: No (no confirmed weaponized exploit or public PoC identified).

Analyst Notes: As of August 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is an authorization regression introduced in recent versions.

Analyst Recommendation

Administrators should treat this as a high-priority update. Upgrading to version 3.40.0 is the definitive fix to restore proper authorization checks and prevent potential unauthorized data manipulation.

---METADATA---
VENDOR: Budibase
PRODUCT: Server
AFFECTED_VERSIONS: 0 up to (excluding) 3.40.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Budibase server versions before 3.40.0 contain an unauthenticated SQL injection vulnerability in webhook-triggered automations, allowing remote attackers to exfiltrate or modify database data.

Executive Summary:
A critical SQL injection vulnerability in Budibase server allows unauthenticated attackers to execute arbitrary database commands, posing a severe risk of data compromise and system persistence.

Vulnerability Details

CVE-ID: CVE-2026-72851

Affected Software: Budibase Server

Affected Versions: 0 up to (excluding) 3.40.0

Vulnerability: The vulnerability is an improper neutralization of special elements used in an SQL command (CWE-89) within webhook-triggered automations. Although the CVSS vector indicates low privileges are required, the description confirms the attack vector is unauthenticated, allowing remote actors to inject malicious payloads into database queries.

Business Impact

Successful exploitation grants an attacker the ability to interact directly with the underlying database using the application's configured credentials. This can lead to total data exfiltration, unauthorized modification of sensitive information, or the establishment of long-term persistence within the database environment. With a CVSS score of 10.0, this flaw represents the highest level of risk to business operations and data confidentiality.

Remediation Plan

Immediate Action: Update Budibase server to version 3.40.0 or later immediately to resolve the vulnerable code path.

Proactive Monitoring: Review application logs for anomalous POST requests sent to webhook endpoints and monitor database query logs for unusual or unexpected execution patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict input validation rules to block malformed JSON payloads targeting webhook endpoints.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to the potential for unauthenticated remote code and query execution.

Analyst Recommendation

The severity of this vulnerability cannot be overstated given the potential for full database compromise. Administrators must prioritize the application of the 3.40.0 update across all production environments to eliminate the injection vector.

---METADATA---
VENDOR: Budibase
PRODUCT: budibase
AFFECTED_VERSIONS: < 3.39.19
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Budibase is susceptible to an SQL injection vulnerability that can be triggered by an authenticated administrative user.

Executive Summary:
Budibase versions prior to 3.39.19 contain an SQL injection flaw that may allow an administrative user to compromise the underlying database system.

Vulnerability Details

CVE-ID: CVE-2026-64657

Affected Software: Budibase budibase

Affected Versions: < 3.39.19

Vulnerability: The application fails to properly neutralize special elements used in SQL commands. The vulnerability requires high privileges (authenticated administrator) and user interaction, which limits the attack surface but poses a high risk to database integrity.

Business Impact

Successful exploitation of this SQL injection vulnerability could lead to unauthorized data access, modification, or deletion within the connected database. With a CVSS score of 8.4, this vulnerability represents a significant risk to the confidentiality and integrity of sensitive business information managed by the platform.

Remediation Plan

Immediate Action: Update the Budibase installation to version 3.39.19 or higher to resolve the database input sanitization issue.

Proactive Monitoring: Review database audit logs for anomalous queries, such as unexpected administrative commands or large volume data exports that do not align with normal operational tasks.

Compensating Controls: Implement strict database access controls and use prepared statements where possible to minimize the impact of potential injection flaws.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the requirement for high-level administrative access reduces the likelihood of external exploitation, the potential for total system compromise remains high.

Analyst Recommendation

Organizations should treat this as a high-priority update. Ensure that all administrative accounts are secured and that the platform is upgraded immediately to eliminate the risk of database compromise.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Budibase low-code platform contains a vulnerability that may expose the system to unauthorized access or manipulation.

Executive Summary:
The Budibase low-code platform is affected by a high-severity vulnerability that could allow unauthorized actors to compromise the integrity or confidentiality of business applications.

Vulnerability Details

CVE-ID: CVE-2026-54353

Affected Software: Budibase Budibase

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides within the Budibase platform architecture, potentially exposing internal functions to unauthorized interaction. The exact authentication requirements depend on the specific vector, but the high CVSS score suggests significant impact on system security.

Business Impact

A CVSS score of 8.5 indicates a high risk to business operations relying on the Budibase platform. Successful exploitation could allow an attacker to gain unauthorized access to custom applications, manipulate backend databases, or perform unauthorized administrative actions, leading to severe reputational and operational damage.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Budibase to all instances of the platform.

Proactive Monitoring: Audit user activity logs and administrative account changes to identify any abnormal platform usage.

Compensating Controls: Restrict access to the Budibase management console via VPN or IP whitelisting to ensure only trusted users can interact with the platform.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of low-code platforms in business workflows, this vulnerability requires urgent attention. Administrators should verify their current version of Budibase against the vendor's security advisory and apply the necessary updates to prevent potential compromise of business-critical applications.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: Prior to 3.39.9
---END_METADATA---

Description Summary:
An improper path validation vulnerability in the Budibase PWA upload process allows authenticated builders to perform arbitrary file reads on the server.

Executive Summary:
A critical file-read vulnerability in Budibase versions prior to 3.39.9 allows authenticated users to bypass directory restrictions and access sensitive system files via symbolic link manipulation.

Vulnerability Details

CVE-ID: CVE-2026-54352

Affected Software: Budibase

Affected Versions: Prior to 3.39.9

Vulnerability: The application fails to properly sanitize symbolic links during the processing of uploaded .zip files for PWA icons. An attacker can craft a malicious archive containing symlinks that resolve to arbitrary files on the host system, allowing the application to read and return the contents of those files to the user.

Business Impact

With a CVSS score of 9.6, this vulnerability poses a significant risk to the confidentiality of the server hosting the Budibase platform. An authenticated builder can exploit this to read sensitive configuration files, environment variables, or system credentials. This information disclosure can easily lead to a broader compromise of the entire server environment.

Remediation Plan

Immediate Action: Upgrade all Budibase instances to version 3.39.9 or higher to implement proper path and symlink validation.

Proactive Monitoring: Review file access logs and monitor for unusual attempts to read system files or directories outside of the intended application storage path.

Compensating Controls: Ensure the Budibase application is running in a highly restricted container environment with minimal filesystem access to limit the impact of potential file-read attempts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, the ability to read arbitrary files from the host system is a high-impact primitive that is frequently leveraged in multi-stage attack campaigns.

Analyst Recommendation

The ability to read arbitrary system files represents a catastrophic failure of input validation. Organizations should treat this update with high priority to prevent unauthorized access to sensitive local files and maintain the integrity of their hosting infrastructure.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity security vulnerability has been identified in the Budibase low-code platform that requires immediate attention from system administrators.

Executive Summary:
The Budibase low-code platform is affected by a critical vulnerability that poses a high risk of unauthorized system access or data compromise.

Vulnerability Details

CVE-ID: CVE-2026-54351

Affected Software: Budibase Budibase

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Budibase low-code platform, potentially allowing for unauthorized operations. As the authentication requirements are currently unspecified, administrators should treat this as a potential remote code execution or privilege escalation risk.

Business Impact

The vulnerability carries a CVSS score of 8.2, classifying it as a High-severity risk. Successful exploitation could lead to full compromise of the low-code environment, resulting in unauthorized data access, modification of business logic, or total system downtime, which poses significant operational and reputational risks to the organization.

Remediation Plan

Immediate Action: Apply all available security updates provided by Budibase immediately to patch the underlying flaw.

Proactive Monitoring: Review application access logs for unusual administrative activity or unauthorized API requests originating from unexpected sources.

Compensating Controls: Implement strict network segmentation and ensure the Budibase instance is not exposed to the public internet without a robust Web Application Firewall (WAF) in place.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High-severity rating of 8.2, this vulnerability represents a significant security gap. Security teams must prioritize identifying the version status of their Budibase instances and applying vendor-supplied patches as soon as they become available to prevent potential exploitation.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: Prior to 3.39.12
---END_METADATA---

Description Summary:
An unauthenticated injection vulnerability in Budibase allows remote attackers to read or modify arbitrary documents in connected databases via maliciously crafted query parameters.

Executive Summary:
A critical injection vulnerability in Budibase versions prior to 3.39.12 allows unauthenticated attackers to bypass security controls and perform unauthorized read/write operations on backend databases.

Vulnerability Details

CVE-ID: CVE-2026-54350

Affected Software: Budibase

Affected Versions: Prior to 3.39.12

Vulnerability: The application fails to properly sanitize JSON metacharacters within query parameters, enabling an unauthenticated attacker to manipulate query filters. This allows for unauthorized data exfiltration or modification across various connected databases, including MongoDB, CouchDB, and Elasticsearch.

Business Impact

Successful exploitation of this vulnerability poses a severe threat to data confidentiality and integrity. With a CVSS score of 10.0, this flaw allows an attacker to bypass all authentication and potentially gain full access to the underlying data stores used by published applications. This could result in the total compromise of sensitive business information, unauthorized modification of production data, and potential regulatory non-compliance.

Remediation Plan

Immediate Action: Upgrade all instances of Budibase to version 3.39.12 or higher immediately.

Proactive Monitoring: Review application and database access logs for unusual query patterns or unexpected mass-read/write operations originating from public-facing endpoints.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to filter and block requests containing suspicious JSON syntax or unexpected parameter structures, though this should be considered a temporary measure until patching is complete.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw—specifically the total bypass of authentication for database operations—the potential for exploitation is extremely high and represents an immediate risk to any exposed Budibase instance.

Analyst Recommendation

Given the critical severity of this vulnerability and the ease of exploitation by unauthenticated actors, immediate remediation is required. Organizations should prioritize updating to the patched version of Budibase and conduct a thorough audit of database access logs to ensure no unauthorized activity has already occurred.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability in the Budibase low-code platform may allow for unauthorized access or execution of administrative functions.

Executive Summary:
Budibase contains a high-severity vulnerability that could permit unauthorized access to the platform's core low-code development environment.

Vulnerability Details

CVE-ID: CVE-2026-50137

Affected Software: Budibase Budibase

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides within the Budibase low-code platform. It potentially allows an attacker to bypass security checks, which could lead to unauthorized access to applications or the underlying data connections managed by the platform.

Business Impact

With a CVSS score of 8.2, this vulnerability poses a severe threat to organizations relying on Budibase for internal tooling. A successful exploit could result in the unauthorized viewing or modification of business data, or the total compromise of applications developed on the platform, leading to potential data breaches and operational disruption.

Remediation Plan

Immediate Action: Apply all security patches released by Budibase immediately and ensure the software is updated to the most current version.

Proactive Monitoring: Review system logs for unauthorized access attempts or unusual patterns in application data requests.

Compensating Controls: Ensure that the Budibase instance is not exposed to the public internet; utilize VPNs or IP whitelisting to restrict access to authorized personnel only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw in a low-code platform, the potential for exploitation is high.

Analyst Recommendation

Given the potential for broad impact within low-code environments, immediate patching is required. Security teams should verify that their Budibase instances are updated and confirm that appropriate network-level access controls are in place to minimize the attack surface.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Budibase contains a security vulnerability within its low-code platform architecture that requires immediate administrative review and patching.

Executive Summary:
A high-severity vulnerability in the Budibase low-code platform poses a significant risk of unauthorized system compromise and potential data exposure.

Vulnerability Details

CVE-ID: CVE-2026-50136

Affected Software: Budibase Budibase

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in the Budibase platform that may allow for unauthorized access or execution within the application environment. Given the nature of low-code platforms, this likely impacts the integrity of business logic and underlying data structures, though specific authentication requirements depend on the vendor's forthcoming technical disclosure.

Business Impact

The vulnerability carries a CVSS score of 7.4, classifying it as a High-severity risk. Successful exploitation could lead to unauthorized access to sensitive business applications, potential data exfiltration, or the manipulation of critical automated workflows, resulting in significant operational disruption and loss of data confidentiality.

Remediation Plan

Immediate Action: Review the official Budibase security advisory and apply the latest security patches or version updates immediately upon release.

Proactive Monitoring: Monitor application access logs for unusual patterns, unauthorized administrative attempts, or unexpected API calls originating from internal or external sources.

Compensating Controls: Implement strict network segmentation and ensure that the Budibase instance is not exposed directly to the public internet without an authenticated proxy or robust Web Application Firewall (WAF) rules.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing Budibase must prioritize this update as part of their standard patch management cycle. Given the platform's role in centralizing business logic, failing to address this vulnerability could grant attackers persistent access to internal business processes.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Budibase contains a security vulnerability within its low-code platform that requires urgent review to prevent unauthorized system interaction.

Executive Summary:
A high-severity security vulnerability in the Budibase platform presents a significant risk of unauthorized access and potential compromise of integrated business applications.

Vulnerability Details

CVE-ID: CVE-2026-50132

Affected Software: Budibase Budibase

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in the Budibase framework that may facilitate unauthorized access or bypasses of standard platform security controls. Attackers could potentially leverage this to gain higher privileges or access data they are not authorized to view, depending on the specific configuration of the platform.

Business Impact

The CVSS score of 7.3 underscores the high severity of this vulnerability. Successful exploitation could result in the compromise of sensitive organizational data, unauthorized manipulation of low-code business processes, and significant reputational damage, necessitating immediate remediation to maintain system security posture.

Remediation Plan

Immediate Action: Review the official vendor documentation for Budibase and apply the latest security updates or patches as soon as they are made available.

Proactive Monitoring: Monitor application logs for anomalies, specifically focusing on unauthorized login attempts or irregular data access patterns within the Budibase environment.

Compensating Controls: Ensure that the Budibase instance is protected by robust identity and access management (IAM) policies and utilize a WAF to inspect incoming traffic for malicious payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of low-code platforms in modern infrastructure, it is imperative to address this vulnerability immediately. Administrators should follow the vendor's guidance to patch the system and perform a routine audit of user permissions to ensure that the principle of least privilege is strictly enforced.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: Prior to 3.38.2
---END_METADATA---

Description Summary:
Budibase contains an authorization bypass vulnerability in the SCIM API, allowing authenticated users to perform unauthorized CRUD operations on all users and groups.

Executive Summary:
An authorization flaw in the Budibase SCIM API allows authenticated users to gain unauthorized administrative control over tenant user and group data.

Vulnerability Details

CVE-ID: CVE-2026-46425

Affected Software: Budibase Budibase

Affected Versions: Prior to 3.38.2

Vulnerability: The SCIM router fails to implement role-based access control, allowing any authenticated user—regardless of their assigned role—to interact with sensitive administrative SCIM endpoints.

Business Impact

Successful exploitation allows an attacker to manipulate the entire user directory, including the creation, modification, or deletion of administrative accounts. Given the CVSS score of 9.9, this poses a critical risk of full tenant compromise and unauthorized data manipulation, potentially leading to a complete loss of platform integrity.

Remediation Plan

Immediate Action: Upgrade all Budibase instances to version 3.38.2 or later to enforce mandatory role checks on SCIM endpoints.

Proactive Monitoring: Review application access logs for unusual patterns of SCIM API requests or unauthorized modifications to user and group structures.

Compensating Controls: If immediate patching is not feasible, restrict network access to the SCIM API endpoints via firewall rules to known trusted administrative IP addresses.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical breakdown in access control. Administrators must prioritize updating to version 3.38.2 immediately to prevent unauthorized administrative escalation within the environment.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Budibase platform could allow for unauthorized actions, potentially leading to a breach of the application environment.

Executive Summary:
The Budibase low-code platform contains a high-severity flaw that may allow attackers to bypass security controls and access sensitive application data.

Vulnerability Details

CVE-ID: CVE-2026-35218

Affected Software: Budibase Budibase

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability exists within the Budibase open-source platform. Based on the high CVSS score of 8.7, it is likely that the flaw permits an attacker to perform high-impact actions, such as bypassing capability checks or executing unauthorized commands within the application context.

Business Impact

A breach of a Budibase instance could result in the loss of critical business data and the disruption of automated workflows. Because these platforms often integrate with multiple third-party services, an attacker could potentially use this vulnerability to move laterally into other connected systems. The high CVSS score underscores the urgent need for remediation.

Remediation Plan

Immediate Action: Update Budibase to the latest version provided by the vendor to address this security vulnerability.

Proactive Monitoring: Monitor database query logs and API request patterns for any signs of anomalous behavior or unauthorized data extraction.

Compensating Controls: Implement strong multi-factor authentication (MFA) for all Budibase users and restrict administrative privileges to the minimum necessary personnel.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. Nevertheless, the risk remains high due to the functional power of the affected platform.

Analyst Recommendation

It is critical to apply the vendor's security updates immediately. Given the potential for high-impact data compromise, security teams should verify the update across all Budibase deployments to ensure the environment is fully protected against this flaw.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: Prior to version 3.33.4
---END_METADATA---

Description Summary:
Budibase versions prior to 3.33.4 contain an unauthenticated Remote Code Execution (RCE) flaw. Attackers can trigger Bash-based automations via a public webhook to execute commands as root.

Executive Summary:
Budibase is vulnerable to a critical unauthenticated remote code execution flaw that allows attackers to execute arbitrary commands as the root user via public webhooks.

Vulnerability Details

CVE-ID: CVE-2026-35216

Affected Software: Budibase Budibase

Affected Versions: Prior to version 3.33.4

Vulnerability: This vulnerability allows an unauthenticated attacker to achieve Remote Code Execution (RCE) by triggering a specific automation containing a Bash step through the public webhook endpoint. The exploit requires no authentication and executes with root privileges within the server container.

Business Impact

A successful exploit results in the total compromise of the Budibase server, allowing attackers to steal sensitive data, modify applications, or move laterally within the network. The CVSS score of 9.0 reflects the critical nature of unauthenticated root-level access. Organizations may face significant data breaches and operational downtime if this vulnerability is exploited.

Remediation Plan

Immediate Action: Update Budibase to version 3.33.4 or later immediately to patch the vulnerable automation logic.

Proactive Monitoring: Monitor access logs for unusual requests to the public webhook endpoint and review container logs for unexpected Bash execution.

Compensating Controls: Implement a Web Application Firewall (WAF) to restrict access to webhook endpoints to known, trusted IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw—specifically the lack of authentication and root execution—the potential for exploitation is extremely high.

Analyst Recommendation

The severity of this RCE vulnerability cannot be overstated, as it grants full system control to unauthenticated remote actors. IT teams must prioritize the update to Budibase version 3.33.4 immediately. Failure to patch leaves the entire low-code environment and its underlying data exposed to complete takeover.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in the Budibase open-source low-code platform that could lead to unauthorized access or system compromise.

Executive Summary:
Budibase is affected by a high-severity vulnerability that could allow attackers to compromise the low-code application environment and its associated data.

Vulnerability Details

CVE-ID: CVE-2026-35214

Affected Software: Budibase Budibase

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Budibase platform, though the specific technical mechanism is not detailed in the summary. Given the CVSS score of 8.7, it likely involves a flaw in authentication, access control, or remote code execution within the application framework.

Business Impact

As a low-code platform, Budibase often handles sensitive business logic and data integrations. A compromise could lead to the exposure of proprietary application data, unauthorized modification of business workflows, and potential access to connected databases. The CVSS score of 8.7 indicates a high risk to the confidentiality and integrity of the platform.

Remediation Plan

Immediate Action: Administrators should update their Budibase instances to the latest secure version immediately to mitigate the risk of exploitation.

Proactive Monitoring: Review application access logs for unusual login activity or unauthorized changes to application schemas and configurations.

Compensating Controls: Ensure that Budibase is deployed behind a robust Web Application Firewall (WAF) and that network access is restricted to authorized IP ranges.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, the popularity of Budibase in corporate environments makes it an attractive target for attackers.

Analyst Recommendation

Apply the primary remediation patch immediately. Organizations utilizing Budibase for critical business functions should prioritize this update to prevent unauthorized access to their low-code applications and underlying data sources.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: Prior to version 3.33.4
---END_METADATA---

Description Summary:
Budibase versions prior to 3.33.4 are vulnerable to Server-Side Request Forgery (SSRF). The SSRF protection is ineffective by default, allowing unauthenticated requests to internal services.

Executive Summary:
Budibase is vulnerable to a critical unauthenticated SSRF flaw because its internal IP blacklist protection is disabled by default in official deployment configurations.

Vulnerability Details

CVE-ID: CVE-2026-31818

Affected Software: Budibase Budibase

Affected Versions: Prior to version 3.33.4

Vulnerability: A Server-Side Request Forgery (SSRF) exists in the REST datasource connector. The platform's protection mechanism is ineffective because the BLACKLIST_IPS environment variable is empty by default, causing the security check to return false and allow all requests to internal resources.

Business Impact

Attackers can use the Budibase server as a proxy to scan and attack internal network services that are not otherwise reachable from the internet. The CVSS score of 9.6 highlights the high risk of internal infrastructure exposure, which could lead to secondary compromises of databases or internal management tools.

Remediation Plan

Immediate Action: Update Budibase to version 3.33.4 and ensure that the BLACKLIST_IPS environment variable is correctly populated with internal and reserved IP ranges.

Proactive Monitoring: Review outbound network logs from the Budibase server for requests directed at internal IP addresses (e.g., 10.x.x.x, 192.168.x.x).

Compensating Controls: Use network-level egress filtering to prevent the Budibase container from initiating connections to sensitive internal network segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, the "fail-open" nature of the protection mechanism makes this highly exploitable in standard installations.

Analyst Recommendation

This SSRF vulnerability effectively neutralizes the network perimeter for any organization running Budibase. It is imperative to update to version 3.33.4 immediately. Furthermore, administrators should adopt a "deny-by-default" egress policy for application containers to mitigate the impact of similar SSRF flaws in the future.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase Server
AFFECTED_VERSIONS: 3.31.4 and earlier
---END_METADATA---

Description Summary:
A regex bypass in Budibase's middleware allows unauthenticated attackers to skip all authentication and authorization checks by appending a webhook path pattern to any API request URL.

Executive Summary:
A critical authentication bypass in Budibase allows unauthenticated remote attackers to access any server-side API endpoint, resulting in complete unauthorized control over the platform.

Vulnerability Details

CVE-ID: CVE-2026-31816

Affected Software: Budibase Server

Affected Versions: 3.31.4 and earlier

Vulnerability: The isWebhookEndpoint() function uses an unanchored regex against the full request URL, which includes query parameters. An unauthenticated attacker can bypass the authorized() middleware by appending ?/webhooks/trigger to any request, skipping all role checks and CSRF protections.

Business Impact

This vulnerability effectively disables the security layer of the entire Budibase platform. An attacker can perform any action permitted by the API, including data exfiltration, user manipulation, and workflow modification. The CVSS score of 9.1 reflects the critical risk to organizational data and the ease with which an unauthenticated actor can compromise the internal tools built on the platform.

Remediation Plan

Immediate Action: Upgrade Budibase server to version 3.31.5 or later immediately to resolve the regex validation error in the middleware.

Proactive Monitoring: Inspect server logs for any API requests containing query strings with webhook-related patterns (e.g., webhooks/trigger) originating from unauthorized users.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests where the query string contains path traversal or webhook-specific keywords used to bypass middleware logic.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, the simplicity of appending a query string to bypass authentication makes this an extremely attractive target for attackers.

Analyst Recommendation

This is a "zero-click" authentication bypass that places all data within the Budibase environment at risk. It is imperative that administrators apply the update to version 3.31.5 immediately to re-establish the security perimeter of their low-code applications.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase Platform
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability exists in the Budibase low-code platform, potentially allowing unauthorized access or manipulation of internal tools and workflows.

Executive Summary:
The Budibase platform is affected by a high-severity vulnerability that could allow attackers to compromise internal administrative panels and automated workflows.

Vulnerability Details

CVE-ID: CVE-2026-25737

Affected Software: Budibase

Affected Versions: See vendor advisory for affected versions

Vulnerability: While specific technical details are limited in the current summary, this CVE identifies a high-severity flaw within the Budibase platform, which is used for creating internal tools and admin panels.

Business Impact

Given the CVSS score of 8.9, a successful exploit could lead to significant unauthorized access to internal business data and automation logic. This poses a high risk to organizational operations, especially if Budibase is used to manage sensitive databases or critical business workflows.

Remediation Plan

Immediate Action: Apply the latest security updates from the Budibase vendor immediately to mitigate the risk associated with this high-severity flaw.

Proactive Monitoring: Monitor for anomalous activity within the Budibase environment, such as unauthorized changes to workflows or unexpected data export requests.

Compensating Controls: Restrict access to the Budibase instance to known IP addresses and enforce multi-factor authentication (MFA) for all users.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 10, 2026, there is no public information indicating active exploitation. The high CVSS score suggests that the vulnerability likely involves a significant bypass of security controls or a high-impact data exposure.

Analyst Recommendation

Due to the critical role low-code platforms play in internal business operations, this vulnerability must be addressed urgently. Apply all available patches immediately to maintain the security of your internal application ecosystem.