Skip to content
Budibase vulnerabilities
Newest
-
budibase
Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation
CVE-2026-103757
8.3 High
-
budibase server
Budibase server before 3.45.0 Cross-Tenant Information Disclosure
CVE-2026-100688
7.1 High
-
budibase server
Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast
CVE-2026-100687
7.0 High
-
budibase server
Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps
CVE-2026-100686
8.6 High
-
budibase server
Budibase before 3.45.0 Information Disclosure via Chat Links
CVE-2026-100685
8.3 High
-
budibase server
Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC
CVE-2026-100684
9.2 Critical
-
budibase server
Budibase before 3.45.0 SQL Injection via column-rename DDL
CVE-2026-100683
8.9 High
-
budibase server
Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink
CVE-2026-100682
8.7 High
-
budibase server
Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook
CVE-2026-100681
6.3 Medium
-
budibase server
Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import
CVE-2026-100680
8.6 High
-
budibase server
Budibase Server before 3.41.3 SSRF via Query Import
CVE-2026-82246
7.1 High
-
budibase server
Budibase before 3.41.3 Missing Authorization License Management
CVE-2026-82245
7.2 High
-
budibase server
Budibase before 3.41.3 Remote Code Execution via Plugin eval()
CVE-2026-82244
9.4 Critical
-
budibase server
Budibase Server before 3.41.3 SSRF with Credential Leakage
CVE-2026-82243
8.3 High
-
budibase server
Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization
CVE-2026-82242
8.3 High
-
budibase server
Budibase backend-core SSRF via incomplete default blacklist
CVE-2026-82241
7.1 High
-
budibase server
Budibase before 3.41.3 Privilege Escalation via User Update API
CVE-2026-82240
8.6 High
-
budibase server
Budibase before 3.41.3 Authorization Bypass via datasources/query
CVE-2026-82239
8.6 High
-
budibase
Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`
CVE-2026-54356
Public exploit
7.1 High
-
budibase
Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist
CVE-2026-35219
Fix available
7.1 High
-
budibase
Budibase before 3.40.0 Credential Exposure via STRING Fields
CVE-2026-72857
8.3 High
-
budibase
Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email
CVE-2026-72856
8.6 High
-
budibase
Budibase before 3.40.0 SQL Injection via Oracle connector
CVE-2026-72853
8.8 High
-
budibase server
Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook
CVE-2026-72851
9.0 Critical
-
budibase server
Budibase before 3.40.0 Arbitrary File Write via Path Traversal
CVE-2026-72850
9.4 Critical
-
budibase
Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect
CVE-2026-67311
8.2 High
-
budibase
Budibase: SSRF via bare fetch() in uploadUrl during AI table generation
CVE-2026-73307
4.9 Medium
-
budibase
Budibase: SSRF via DNS rebinding in the REST datasource integration
CVE-2026-73410
8.5 High
-
budibase server
Budibase before 3.40.0 NoSQL Injection via MongoDB datasource
CVE-2026-73617
7.1 High
-
budibase
Budibase: Account Enumeration via Login Lockout Response Differential
CVE-2026-73306
5.3 Medium
-
budibase server
Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF
CVE-2026-72849
8.7 High
-
budibase
Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector
CVE-2026-73408
7.6 High
-
budibase server
Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter
CVE-2026-73618
8.7 High
-
budibase
Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders
CVE-2026-73308
5.7 Medium
-
budibase
Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint
CVE-2026-73406
7.5 High
-
budibase
Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152))
CVE-2026-73407
9.0 Critical
-
budibase
Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified
CVE-2026-73302
9.0 Critical
-
budibase server
Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST
CVE-2026-72855
8.4 High
-
budibase server
Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL
CVE-2026-72859
8.3 High
-
budibase
Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile
CVE-2026-73409
5.1 Medium
-
budibase
Budibase: SQL Injection via `multipleStatements: true`
CVE-2026-73300
9.6 Critical
-
budibase
Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)
CVE-2026-73303
8.2 High
-
budibase
Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users
CVE-2026-73304
Fix available
4.9 Medium
-
budibase
Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings
CVE-2026-73301
4.3 Medium
-
budibase
Budibase: Privilege escalation via public role assignment API missing app-level authorization
CVE-2026-73305
8.8 High
-
budibase
Budibase: Anonymous NoSQL operator injection via published-app query templates
CVE-2026-54350
Public exploitFix available
10.0 Critical
-
budibase
Budibase: Potential SSRF DNS rebinding bypass in outbound fetch validation
CVE-2026-54353
Fix available
8.5 High
-
budibase
Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload
CVE-2026-54352
Fix available
9.6 Critical
-
budibase
Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override
CVE-2026-54351
Fix available
8.2 High
-
budibase
Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials
CVE-2026-50137
Fix available
8.2 High
- Show olderLoading…