Budibase Server versions before 3.45.0 fail to redact plaintext datasource credentials when broadcasting external table updates to the Builder collaboration websocket room. As a result, attackers who have Builder access can intercept unredacted datasource objects that contain database passwords and API keys, leading to the disclosure of sensitive authentication information. The weakness is an example of insecure data handling, classified as CWE‑200.

The vulnerability affects Budibase Server (budibase:server). All releases prior to 3.45.0 are impacted; no specific sub‑version ranges are listed.

The CVSS score of 7 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. EPSS data is not available, so the current exploitation probability cannot be quantified. Attackers must possess Builder collaboration access, which suggests that the risk is limited to users with that privilege level, but the exposure of database credentials represents a significant confidentiality breach for affected deployments.