Loading vulnerability…
CVE-2026-72851 is an unauthenticated SQL injection vulnerability affecting Budibase Server versions before 3.40.0. The flaw exists in webhook-triggered automations that include EXECUTE_QUERY steps. Budibase webhook triggers are publicly reachable and accept attacker-controlled JSON in POST requests; that input is flattened into the automation context and can be used to influence SQL executed by the automation. Because the EXECUTE_QUERY step runs using builder-configured database credentials rather than per-user authentication, injected SQL executes against connected datasources with the privileges granted to the configured datasource account. In synchronous automations that include a COLLECT step, query results may also be returned directly in the HTTP response.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical unauthenticated SQL injection in Budibase webhook-triggered automations that allows attacker-controlled JSON to execute SQL using builder-configured database credentials.
An unauthenticated SQL injection vulnerability in Budibase Server before version 3.40.0 affecting webhook-triggered automations with EXECUTE_QUERY steps, allowing attacker-controlled SQL execution using configured database credentials.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.