By vendor

Budibase vulnerabilities

Known CVEs affecting Budibase products, prioritized by severity, with SEC.co remediation and detection guidance.

4 published vulnerabilities

• CVE-2026-54353HIGH 8.5

  Budibase, an open-source low-code platform, contains a server-side request forgery (SSRF) vulnerability that allows authenticated users with automation permissions to access internal services and cloud metadata endpoints. The flaw exploits a time-of-check-to-time-of-use (TOCTOU) weakness: the platform validates a hostname against a blacklist before sending a request, but the underlying network library performs a fresh DNS lookup during the actual connection. An attacker can craft a malicious hostname that resolves to a public IP address during validation (passing the blacklist check) and then resolves to an internal IP address (like 127.0.0.1 or cloud metadata services) when the real connection attempt occurs. This bypass gives attackers non-blind SSRF access to services only reachable from the Budibase server itself. The vulnerability was introduced prior to version 3.39.9 and has been patched in that release.

• CVE-2026-54351HIGH 8.2

  Budibase versions before 3.39.9 contain a vulnerability in their webhook trigger system that allows an authenticated attacker to hijack automations. By crafting a malicious webhook POST request with a specially modified body, an attacker can trick the system into executing an automation under a different application context than intended. This grants the attacker unauthorized access to read and modify data in the victim's workspace database. The flaw stems from the webhook endpoint accepting and passing unvalidated user input directly into automation parameters without proper access controls.

• CVE-2026-50136HIGH 7.4

  Budibase, an open-source low-code platform, contains a flaw in versions before 3.39.3 that allows an unauthenticated attacker to generate AWS S3 upload URLs without proper access controls. By knowing a workspace ID and datasource ID, an attacker can craft requests to obtain signed URLs pointing to arbitrary S3 buckets and keys, potentially enabling unauthorized data uploads to cloud storage. The endpoint is protected only by CAPTCHA, bypassing normal authentication and permission checks.

• CVE-2026-50132HIGH 7.3

  Budibase prior to version 3.39.0 contains a critical account-linking flaw in its public chat integration endpoint. An attacker can craft a malicious link that, when clicked by an authenticated Budibase user, silently binds that user's account to the attacker's Slack, Discord, or Microsoft Teams identity—without the user's knowledge or consent. This gives the attacker the ability to impersonate the victim within chat-integrated workflows and potentially access sensitive data or perform actions on their behalf. The vulnerability requires no special privileges to exploit and succeeds through simple social engineering (tricking a user into clicking a link).