Description
Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources like Snowflake.
Published: 2026-08-13
Score: 9 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Budibase prior to version 3.40.0 includes a flaw in webhook‑triggered automations that perform EXECUTE_QUERY steps. Attackers can POST specially crafted JSON payloads to the webhook trigger endpoint without authentication, causing the application to execute arbitrary SQL using the database credentials configured by the builder. This allows attackers to read sensitive data, alter records, and persist changes in connected data sources such as Snowflake, thereby compromising confidentiality and integrity of the data.

Affected Systems

Budibase Server releases earlier than version 3.40.0 are affected; all users running the product before this release are susceptible.

Risk and Exploitability

The flaw carries a CVSS score of 9, indicating a high severity level. No EPSS score is currently available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Because the webhook endpoint is unauthenticated, exploitation can occur over the network from any host that can reach the endpoint, making it a remote attack vector with significant risk if unmitigated.

Generated by OpenCVE AI on August 14, 2026 at 00:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Budibase to version 3.40.0 or later
  • If an upgrade is not immediately possible, disable or remove all webhook‑triggered automations that include EXECUTE_QUERY steps until a fix is applied
  • Restrict traffic to the webhook endpoint by limiting access to trusted IP addresses or applying authentication mechanisms in front of the endpoint

Generated by OpenCVE AI on August 14, 2026 at 00:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources like Snowflake.
Title Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook
First Time appeared Budibase
Budibase budibase
Weaknesses CWE-89
CPEs cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*
Vendors & Products Budibase
Budibase budibase
References
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}

cvssV4_0

{'score': 9, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Budibase Budibase
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-13T21:54:43.318Z

Reserved: 2026-08-10T15:14:51.468Z

Link: CVE-2026-72851

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-13T22:17:24.450

Modified: 2026-08-13T22:17:24.450

Link: CVE-2026-72851

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T00:45:17Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')