Budibase: Four High-Severity Flaws Including SSRF and SQLi Disclosed Together
Four high-severity vulnerabilities, including SSRF and SQL injection, were disclosed for the Budibase low-code platform on August 17, 2026.
Key findings
- Four high-severity vulnerabilities disclosed for Budibase on August 17, 2026.
- Vulnerabilities include SSRF, SQL injection, and unauthorized attachment access.
- Affected versions are prior to 3.40.0, 3.39.19, and 3.41.3.
- Patches are available in versions 3.40.0, 3.39.19, and 3.41.3.
On August 17, 2026, a batch of four high-severity vulnerabilities was disclosed for the Budibase open-source low-code platform. These vulnerabilities, affecting versions prior to 3.40.0, 3.39.19, and 3.41.3, could allow for SSRF, SQL injection, and unauthorized access to sensitive data.
Network Request Agent Bypass (CVE-2026-73410)
A vulnerability in the network request handling of Budibase, identified as CVE-2026-73410, allowed for bypassing validated addresses through a Node agent. This occurred because the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore the agent and re-resolve the hostname. This flaw impacts versions prior to 3.40.0.
PostgreSQL Datasource Connector SQL Injection (CVE-2026-64657)
The PostgreSQL datasource connector in Budibase was found to be vulnerable to SQL injection, detailed in CVE-2026-64657. Versions prior to 3.39.19 are affected due to the interpolation of user-controlled schema configuration fields into a SET search_path statement without proper escaping of embedded double quotes. This could allow an authenticated administrator to manipulate the database schema.
Attachment Upload Vulnerability (CVE-2026-54356)
An authenticated user with the BASIC role in Budibase could exploit a vulnerability in the attachment upload API, CVE-2026-54356. Versions prior to 3.41.3 are affected by this issue in POST /api/attachments/:datasourceId/url. Attackers could supply attacker-controlled bucket and key values, potentially leading to unauthorized access or manipulation of attachments.
Automation Step Vulnerabilities (CVE-2026-35219)
Several automation steps within Budibase were found to be vulnerable, as reported in CVE-2026-35219. Versions prior to 3.41.3 are impacted in components such as outgoingWebhook.ts, zapier.ts, n8n.ts, and slack.ts. The exact nature of these vulnerabilities is not fully detailed but they exist within the automation step implementations.
Response and Mitigation The disclosed vulnerabilities were addressed in various Budibase versions. CVE-2026-73410 and CVE-2026-35219 were fixed in version 3.40.0. CVE-2026-64657 was patched in version 3.39.19. CVE-2026-54356 was resolved in version 3.41.3. Users are strongly advised to update to the latest available versions to mitigate these security risks.
This batch of vulnerabilities underscores the importance of regularly updating the Budibase platform, especially given its role as a low-code development environment where security misconfigurations can have significant downstream effects. Users should ensure they are running patched versions to protect their applications and data from potential compromise. ,key_findings:[