Loading story…
Budibase disclosed two high-severity vulnerabilities affecting its low-code platform, including an unrestricted server-side request forgery tracked as CVE-2026-33226 and a stored cross-site scripting flaw tracked as CVE-2026-35218. The SSRF issue affects version 3.30.6 and earlier in the REST datasource query preview endpoint, POST /api/queries/preview, where an authenticated admin can supply an arbitrary URL in fields.path and force the server to make unvalidated HTTP requests. That behavior can expose internal-only resources such as cloud metadata endpoints, internal databases, Kubernetes APIs, and other internal network services, with reported risk of OAuth2 token theft and potentially full Google Cloud access in some GCP deployments.
The second flaw affects versions prior to 3.32.5 and stems from unsanitized entity names rendered with Svelte's {@html} directive in the Builder Command Palette. An authenticated user with Builder access can inject malicious HTML into names for tables, views, queries, or automations, and the payload executes when another Builder-role user opens the palette with Ctrl+K, enabling session cookie theft and possible full account takeover. Budibase patched the stored XSS issue in version 3.32.5, while no public patch was available for the SSRF issue at the time of publication.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Budibase disclosed CVE-2026-35218, a stored cross-site scripting vulnerability affecting versions prior to 3.32.5 in which unsanitized entity names were rendered in the Builder Command Palette. The company fixed the issue in version 3.32.5; successful exploitation could enable session theft and full account takeover for Builder-role users.
Budibase disclosed CVE-2026-33226, an unrestricted server-side request forgery flaw in the REST datasource query preview endpoint affecting version 3.30.6 and earlier. The issue could let an authenticated admin trigger arbitrary server-side HTTP requests and potentially access internal services or steal GCP OAuth2 tokens; no public patch was available at disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Budibase disclosed two high-severity vulnerabilities in its open-source low-code platform that were patched in version **3.33.4**. The most severe issue, **`CVE-2026-35216`**, allows an unauthenticated attacker to trigger an automation through the public webhook endpoint when that automation includes a Bash step, leading to remote code execution as **root inside the container**. The flaw is classified as **CWE-78** and affects Budibase versions prior to 3.33.4. A second flaw, **`CVE-2026-35214`**, affects the plugin file upload endpoint and lets an attacker with **Global Builder** privileges exploit path traversal using `../` in a multipart upload filename. Budibase said the vulnerable filename handling can lead to arbitrary directory deletion via `rmSync` and arbitrary file write through tarball extraction anywhere the Node.js process has access. The issue is classified as **CWE-22**, also affects versions prior to **3.33.4**, and was fixed alongside the webhook RCE in the same release.
Jun 29, 2026
Budibase disclosed seven vulnerabilities affecting versions before **3.40.0**, including **CVE-2026-72851**, a maximum-severity unauthenticated SQL injection in webhook-triggered automations that use `EXECUTE_QUERY` steps. The flaw lets attackers send crafted JSON to public webhook endpoints and run SQL with builder-configured database credentials, creating a path to data theft, unauthorized modification, and persistence in connected data sources such as Snowflake. Budibase said version **3.40.0** remediates the issues and reported no known active exploitation at publication time. The disclosure also includes **CVE-2026-73300**, a MySQL SQL injection tied to `multipleStatements: true`, and **CVE-2026-72853**, an Oracle connector SQL injection in post-write row lookup caused by improper escaping of table names. Additional issues reportedly exposed plaintext MongoDB connection strings and Firebase private keys through the datasource API, enabled cross-workspace automation execution, introduced AI table-generation SSRF, and allowed arbitrary file write via path traversal. Organizations running Budibase were urged to upgrade to **3.40.0**, rotate potentially exposed MongoDB and Firebase credentials, and review webhook exposure and database permissions.
Aug 18, 2026
A server-side request forgery flaw tracked as **CVE-2026-48153** was disclosed in Budibase, allowing an authenticated user with builder-role access to abuse the platform's OAuth2 data source configuration and force the backend to send requests to attacker-controlled or internal endpoints. The issue stems from loose Joi URI validation in the Token Endpoint field for a mock OAuth2 data source, enabling requests to internal services such as AWS Instance Metadata Service at `169.254.169.254`. When the OAuth authentication flow is triggered, the backend issues a POST request to the supplied endpoint and may expose the response through logs, the client interface, or workspace context, creating a path to credential theft and internal network reconnaissance.
Jun 29, 2026